docker-stable-24.0.9_ce-150000.1.39.1<>,ip9|mfM2@/YYhw8bɣ# E2d;9aU5MJ#y\]8õp̠ ўN KǍ1oXA;iG?RӀ Os$?sd ( Q! 7I^dl t8  8  S\ T8W[_`cPc(dd(g)(ggg(g8g%9lH%:4%=C>C?C@CBDFDGD4HGIJXKYKZL,[L4\LH]O^abcRccdd{edfdldudvg wkxnyr$zrlr|rrrrrsCdocker-stable24.0.9_ce150000.1.39.1The Moby-project Linux container runtimeDocker complements LXC with a high-level API which operates at the process level. It runs unix processes with strong guarantees of isolation and repeatability across servers. Docker is a great building block for automating distributed systems: large-scale web deployments, database clusters, continuous deployment systems, private PaaS, service-oriented architectures, etc.imourvedreGwSUSE Linux Enterprise 15SUSE LLC Apache-2.0https://www.suse.com/System/Managementhttp://www.docker.iolinuxppc64le# /etc/sub[ug]id should exist already (it's part of shadow-utils), but older # distros don't have it. Docker just parses it and doesn't need any special # shadow-utils helpers. touch /etc/subuid /etc/subgid ||: # "useradd -r" doesn't add sub[ug]ids so we manually add some. Hopefully there # aren't any conflicts here, because usermod doesn't provide the same "get # unusued range" feature that dockremap does. grep -q '^dockremap:' /etc/subuid || \ usermod -v 100000000-200000000 dockremap &>/dev/null || \ echo "dockremap:100000000:100000001" >>/etc/subuid ||: grep -q '^dockremap:' /etc/subgid || \ usermod -w 100000000-200000000 dockremap &>/dev/null || \ echo "dockremap:100000000:100000001" >>/etc/subgid ||: if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in docker.service docker.socket ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi #!/bin/bash tail -n 2 $0 | /usr/sbin/sysusers2shadow RET=$? test -f /.buildenv && exit 0 exit $RET ######## data below ######## g docker - - - - u dockremap - 'docker --userns-remap=default' - - if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in docker.service docker.socket ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi PNAME=docker SUBPNAME= SYSC_TEMPLATE=/usr/share/fillup-templates/sysconfig.$PNAME$SUBPNAME # If template not in new /usr/share/fillup-templates, fallback to old TEMPLATE_DIR if [ ! -f $SYSC_TEMPLATE ] ; then TEMPLATE_DIR=/var/adm/fillup-templates SYSC_TEMPLATE=$TEMPLATE_DIR/sysconfig.$PNAME$SUBPNAME fi SD_NAME="" if [ -x /bin/fillup ] ; then if [ -f $SYSC_TEMPLATE ] ; then echo "Updating /etc/sysconfig/$SD_NAME$PNAME ..." mkdir -p /etc/sysconfig/$SD_NAME touch /etc/sysconfig/$SD_NAME$PNAME /bin/fillup -q /etc/sysconfig/$SD_NAME$PNAME $SYSC_TEMPLATE fi else echo "ERROR: fillup not found. This should not happen. Please compare" echo "/etc/sysconfig/$PNAME and $TEMPLATE_DIR/sysconfig.$PNAME and" echo "update by hand." fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable docker.service docker.socket || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop docker.service docker.socket ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in docker.service docker.socket ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart docker.service docker.socket ) || : fi fic7({Y D * z%j=!p !9%N3S* =H W [czB   /6~ C 3%%< '{  6xWES3>:1*F X Ek%sVW=b/@<\2L5O'@)  \ 1( =~JG &Z`({A聠A큤AA큤A큤A큤Aiiiiiiiiiiiiiiiieiiieiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiia96c13aa62dba0ba72e422703eba9ae57bb381c0793e49cd51fc1f056b1501552c5ee6dfb01ee498a1ba8d373a8124584325abd6b9fd4d9378315ea4a148a3734355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865641e7172aecfa6a40a9a527edb81ec32f93316fffd55ddc57056c06713d1a5c17c31c7dc32912a3e4a3c397b9d52a53584b2fadaeb87a025befff1010cc68798955616388d36c6767fca087404e6a4740f9a37bfa5a4caffff23f22ed6614c14449aaac7f02d09a8b89386d06fed1443c838bbbb9f88c002b0333638d9840aa3b14e0057afa4ac1e691116f48cbe8f89ff62bc319f02a7850624273013aebb3d2778d52ceb07f545bee4a36f2de7d278b8d1b3f522d35a8d46b685eac0e19366c288873fc1cbcddeb816ff1f7914339f69555ac4c5e147dbc61692d82b0c48cde5af37e16b3ed9f4d3afca28e628c4f15c9053a902f80bec2c1a6109a7a1ae6ce79e09781c56252b74e90b4113e19ff8b6e14044adc1af2f4a6aa40372742c79b35cd2f6ea1d7f69576c38b07420e091600a69744c5cea2a32a710fb91abf2317c87873291f289713ac5df48b1f2010eb6963752bbd6b530416ab99fc37914a8d9175d4b02ce57809365b29b1b90cc9c6900615aea3990f9f0585f45537bfc9483a4f86b19994d7ee4dd1c39b50092a218fc03d43e51708cbb78f7f36706577937736f7496d39fb4950717c98e25c580bffb5a868fba71faa42f78b3b13e515d3809f29b39afe457a353bfe66f0de89f5f7aa665f5050143b5876a255637b5c926de74445ba64e56e842e6e86dcc7ae9803849bbe5564a64f126e7b39d19a2c8506b0aafeb5d6d2c7e54ce7abff3ce29c4ef256d2464814037822b4f615b4e8506aa990a4c1a1ce3cf45a84ea61a613dd493386d793dceb769d3366163996fa66a987c5e12ce238aca8c2ab40a64f4fc1ada843def22460d994f9d5e052d481514647f4af820c7c7747dd90a154e8d579dab77479427c6b23079a5979ca87c933efa5ec8bbd0bd009032dc1bd5b1173aa05f9f2d958617c8e01a1b8c7d0f35b09fa11309d08cff02224da219df52e52770d650eb6b932bdc72b792298e9c2890362972ab5c42b56a23f04bab02a49e8d8a149f58700ee9acad5ce67397de458e22cc5779e54f03c7619b1eecadb835a599bb2a8f7c9b2dbc0484334f7f6fbad915319c4fe1c74a5fec8a716c09fb301b63da509213cc4f4ff5b5a4d5d079db1e40cbb4f2ce2c7d97bd3152b267e6950592cfd781bf99fd3f563627eed51febd1c41644b5f707678153c6467e80d67d66e54fdf44725f092cc064d1e293f22a8c3a0ecc3cd619513d04cef58dc121a62497f479eb6624c475015c805247751f0da7924c46afbe9c9153b475e4d28433405dd7425f0859f2db021b9c1f624000a4f5a6af74f7c858e8320e5e71f711f9f54fd85b3c6fdb34160e763ae33a6a1b27442ea722ff67562b56291c1d08659bae576924bc0142dd2478966121ec47624583d71309d1ff8137ea139f75593399a58298c6235806dc5d70ba361be164159e705dca75cf07f847f8939c86d64304713fbf5ea38fa2ed1c3127fb34e5a02870dce2fd28a407626ba3a4cda399796cfc0734097fb8f278bdda9a95da2b8a56185f349f73d26d30238723d035f29f68b6d9b20a286901fd014bd86bda77bdf3f6950c08ab448c27e58a06c5c8eebc6bd2621f7a43e84c3c623b8e5673b85bb184aeca47393e6729a2ba951bdaaa1b359462d356ee796cf24e36cece92da38276f474fed739d68033e3d21e08958868266c73d9753d96a4e704f8dabef1445b8a7f271566e2d8e95b28597802fd0972c188124a2698482283c89b20e216c8e2d07d997bf27b6c1ae622957429462650a7bb332aef876029cdab0d883a6e537b978dfeee5858ddfde956c24e11b4bcb3147e68c1fec328380d3f252116195483dcb812c0963a6bd08c00d31fd3394119e4d8a98bf86aae060f60c3db5418ec61f934255b2390edaa82ef3102f5f1896e959cb22fd3c62f2a08d98e22a96c4935db86fbb818e06a6fb75ab747a19d5bbca47ae4dca504b6e8d253a185adead2936f40453939683f66bf53791d6439c6ace07048457899d6136427d513df40cc9ceb0236d307e6fadfb33de34c4fd3ade1965d346bf674e43e8643411fbd521d7d286f22a4dab169a17da3e9d171462451ce299d0dc5266422b2d6f36fd5bc9833385ac0f0caa48de9b6180a6164b201ca29a64fa747434f3a0be7d1c8813d6e07199fa12a10387d288fffd7388fdafc41efe49d325a0990a6c1f753c1efbb5211ea05a14cd1ff390dfe760db823d5cc72b1f434aa26805d72be69cb9a7d8bc420fca0ecc6c90ae8fd716a90ac3dd4bb2f76948d667e560708f9b01f9e8245b3ac0a91bbedb9d04b1fcb01f21aa019a69b723c51dfd79a368da151a0ddfa1526dd513df56523f752accb5f5ebc6ffbfce75937fec8c5207e25dd84cb7eb302619d8661e53db14ba05c5d375ad944cc2357111903e0c7afbcc32bc5ae4b956db9c3985b4b9aadfcf78ce79bf34d2d45b48db4b206d5f093c62a650e667a6c6a334a163decb53cff6e0e2b02a3d655d3171556b7705ba418aa9e80bd18874f1610405b0a4930d0d62abe3563ade7f95d650a0a699eaaba4d03b6f628579ffb0e52e7f07c55e202fca7693eaf852289e6c7905ca4a0e06882c102fb8240c98ea68a656aeb1ed08f3e74c27a7b9dbfd0065b10e09987586b009120092ba3ea6c566496e9990622b344e8b953bddc9aabddadb8eaee4382876dc728a9843f8bf6dfee20901dcec0962ec259b4dda8eccd226a13dcb123895755954d8bd892ecb462fb1941961f6e5cf7daa75dcd28e064c78078d698b7a1cbdd31c0fa713bc333d39593ddedfbca90592407cd820c14ef6dc5ab3ce3fb166928a34ffc3318d794a0c9533f7360ad52a3e62f0cab29984a44340269b8be611a92c6cf54e9da83fa3a88f0875428278cb571962a15cb5b5ce6bae7ddca492540fae0ee8be10ecb4b2be1181a898648ff033ef3b52de58a0f43d2ddac06752e333b0bccc12d07bfdd3433a27307e83abff5ce554cc07579940cefe6419f07b41bfaee3375004ca5528f3ddbfea15bb88465da3d9e466794dde8c44967fe5aa9ed19d71e970a768c8694c9d601f82380d629b529b1c20d3122fe2e5af760eb0bf17fece1e9286a800a9d1325a4c0dc8b0b97f4150c893f661ab6602b79fef8fbdfae210c26e408392c873d16f3cf3a9c8a8002311f3356c7f6de2de2a9d2ccac88019c812b418c68765439ea7273b41a33c0a0b69e5b817b1cc2076aafda7d9384315df664a3bfb6c97b12bdfee094bd60866d38fe871aad8161a7bb834516502293ad33cb91ae208917f02774067e420db2157e50f5500efc2749e916e0b8b676bcc74f7e78158221532dcdc5c90ae7e6bfff7ee7b551b593bcb6d6034f5925cc69d8825a9cde36dc398db90f8401915e151bb28f64b37e93c94c565ee767f1df338e32011b414925b7f8682f43f1578b9f14769f5cb5287a5c49ae92fbd8dea860a36e6e0cd40bb514298155a622013dfc85bd43f1d94d01c3916bcb0df0847f49154ac4c32b5eefc1322662d3e928e92ed95ace5b5c239077fe76b73b8795d88c7ec9376ae75a92210025eb4d5b6b22a1102e5f64bace39cfff782877378c8188c76d5cf52b1d8dab0a5974a47f40ada8d0c929b510e094bbaec604d62ca5487d639009cbf5fb7e16ffedc44cd2baf71aa8fb33b4fc0e9ffb3ba72f056e685eea93a3ac36859daf06bbe1d9cba2a08acea89a41ccb3e46664dfb33f65360259a39bec17ef6c28ea51ba2b8f66e13c94bb52c91c5c7a01e237b04cbfa0f07b52037d50de82d20fd8edcfecaea166436b904cc7f6ba0012698dd27d507d71cbb00e7fc0aa0d6e686e84840cf1114bdf675380d0d2493a9cc289e0c20070dc4c6a025bf19ef03089568226f4bfed4b6f34f24bf20d1b47c5adf535f46a209e04089edec4a61e4bc79bdff5a72e55f3f3d531822199f5fb2d3f0bafe574a4e656bd4a9cd68a3c57344b1f6b49162c4d049e8574c8da8f5e4d5010f8a0722893de5058f746d35042ad9cded38ed6c97b4bd7b11be09d71d6d3e999d4f0cb3d849ee17d64a92bb0708441f709e4fef3bb349f9c395a4f61011edcbc20155fb950a9a2569700a56f4ae95168905364c2f4fcc2938c26f15790239b23498fc8987312e41a2847d992f3c3794a2e252e4b73f5616f1ef4254c69c91cdcab2295a6dc924a563bcf1ff225d26a4c8ea13bdfc73532f31b0ea300f9fd29a7fa801ccef48bf81d5eb4ac5e3ee9926c3491385fbe0fe5474c537a8c354ef7d8ccfdf72c85d8bd9b265466fe72c77235513bca8426f455babc7a876563dd3392a088763e87b566d4ca081629799c1238918fc7ba3395124dcce5d699a2647ff32833f54452fc72e71f273496292691e13eea1499b85674e41eaf7a17ff61195a07526d08f0b7b007314f883dfe60399a6f4442d211f0f449249bce13d2dfd2d214a9eca7fe6a14ea457dcdb581699d06464257750797bd626d307bafca72ed990d4052f9d1fa84642d66315d4f444366b4fec82ff3766c057c22b788e6aa527297330b56d85ac170f8fdf16c21f80407654aefb62b29b271bb2a67312b60ed253a7d044e00ff6d49346b6709431b7582d6629046ba8c08922681a13aed0a8b19bbae8445bf466c7ef8e3bf53090418592df6445b90681e23af953d0b5518694c0e876d629d3cf1ba3df567de4447cf03578c5e9149c75eb498525897e9ef1b305f868045db5c98c512525014ad11c775fdb2b3e3749fd25bf9ae6522c291c0e015f9c4b884395309dac14fc144d1ca22a78d3804fd192833f015a6043eb97570da7a67de0eae7d3b2427c7c64fca49e98ed63717beb9f54777aa358ce81a43f2d2e6f9e7b4d39b9eb23e8020bb986bd1aff7f6b36df3ab4547b913f42d2a401d4e5453dbba92abe9509eb3c30eb7e0dbebe42b6c6a134183bc7a008002c9717404725ec60938124b28a0af3336175adcb7f288a53cc3c499c4853b6c9858256ef771c32350c1b36969d4d2548894dccc819ca0fed8f0045a4582f009ce02019df0395cf9b717ae59fbfe30406c470cecb1a86e3f3036e3d1c2c839b0671078277c1a0ebbb38b985e5b0446531c35cfd9aae1bed15375c6070167b9880c0ff90cd11ed813cfd23f8ee58591b056e53dda219dc8fd95d9315ee306bfb6f98efd182dcb96f7a33e25b34fa4dd500ec192b94558aeceaa35cca4728f5e4c2220ea58dc85c820462e35023d95d065178dc00e98a9bf6f2de9f8b838e840f2a5394348c8a949553e5e2dd61839a4a9e2846cffb251af08fe128f968561130fcc9e95cd2bc8ce18a1a2e8edf8cbf47b26b91209ac1d6a7813d7ee1393c51960ba716bc4650ab5393929c98468e1c2495c3fc9d378e6dfe9381278ecab31e1b1f1df47ca9069c8bf17df0d07c872bb99e02dbd53fa3233854e0478ab50ecb470a927fa54d2e43ca22807af7302c859f5fbacd56a0837d836718b430b68e99ec98eaeca7e10a4b41680b01991cb0b2a1b7def4adf7b4dc0cfc760b1d05b0c4bd245f9d5d6d3dfd2fec073579259878d95120abadf8d016e9065a0db9604f61653b4cef88fc3fe71cecc8799ba30e0e0eae3b52177d50b85603c5dacd9e7b5b977fa6ea6a010a4f63226104832a5bb3243c4ca6417187d96bb27e3a296ef0508467162f6bf441990c70049c70450fd0c48480f2755a76a94b46e09376e0bed1bf0858ce487384bdd111ac0d39579feb1893e3d13bcf0e959187e621af1aaf52fa922558923a38d278cdcc8e243f8910e26077b63439354826d83c16b6d461d8761d013abe5af2401444fd0cf39c5e9927f9fc1e52c6fb6783b9bcc8fe7cfed6b6430d980c0229d4cabd1f61c16d577cf22eb5600fa53f2580fea71239066bf679ed1e035e9a159a77c3e2b9e61ecbc686be3dcd5e06ad77f9e47968e0afe5a6d29ca6f488b37757f3933984ef5b4845c55ee141a1c7772921de7cba7d0530e42fb7d82dc762028b24d2d1c27edfd31d8c59a635a423c92bc0656ac62d90fe3a95e8a2c80831fdfeda74ca9a554a74b0a593b6db539e56f40a9ba1e76aa0409a8123ef3285c91da199928d1a1aff7adf53ebe2e8d5dc4b959aa31ce3a3183ed76d48ab43ffa46cc04f2d8c74b53e49e6e8aec37691edbce41a4911c82fbbbfcd3391c1542624b202427c4fe3a6f16f2543703152fc5283379d5149affb1508c3c7e93ad7a72043e691a536502e0cbab5faac9a7988711b0b0c14e6dfd57069143cf215586ee5511e3a24589bb94962d536e997efddc4609bffb4044c27cfe2d9b689f5e8253216818d762285c4cd37bc2c0cafc1c72a80f050b54b862efd22d46babdc78a9df5cfec9783c222e417c0a79eee451281c6e5b13e90335440fb382f68705100baba76c0787a6a9eae878ec7fe1496297d1a8563e5d146cfcbe5677c3648a2fd8e963a1e906c277c41c3663c356953dfc893fd3d1d1f95e129b5acd5c6097691ca2041cfbc60111d11bd97603f8fa460444cddffdbc31caa3b43381c54e08e32aeae8172474c8eb1f9b3f1c7f03900e1b448ca939d06df58d1d548b73b4b3649b2d1e253674781684ecd9092ac7d18da8e8ad1f9a49779aea333ae42e8d8e2291d785d6593fbc01473b1fd72aab17ab057482f9dac44daf6e8e2f4431a58e755a0bba0f4c3a005fc70aa6cad8cdb509df83e7072a5aa419714d22c3378ce76af2ed6d8f51ba0f8cd9a1f344d01b5f3a67c8d00db7135205f61c64c21f73e60ba0ee4e0e042a3c144df6b553b300be713b9254ac47820216a24e256e9e1707fa46cdb5c557f5bcd94bdbd61e91d3b41f169e05fc2617d57cda6d4c09f055f1d65a7dc3c536924d945c74d6fc22c6b2af8906f85ebbb96300e2a7e500e1263a45f2e0c64429c0a9d287361ff548d71c71b3a2e8ea9cc84b9fec23d0926e136db88f2bbd5fd1255dffc97e032eb756245272ebedbfb042ffd63b771c5622ea41189ba7b38078c9333c683ec79fdf7b240846c90b211b9b2dfcefaaf2696f030be941875bfa42b730003723e12dd0a67e9d1353b22bbea60ea2d9220cfaecd396f7a264312660442563a34103ce6e138ac75ec435c61238fcbabb57983c81417ba424e1b485cfb5cfcd3001a2301e26c20ab5eb0e2abeb40c1ccc26b70a65c8ea39ebbd31d6c226f83c9d2fc5e1e3db8cf09a829221b116ecd1dc2cae3341c7c3f0e9ed3e7b09190e6ee27de52e2726963d82b2c0981c93720000b7eff8904384519cb981388c8e216ff640708f96498fce1421db9ff61940b0ee1779ea40b7818cc5256506c742b06462d8bead6eba1dcb7e9e564ba044d9d9ee4f9ffa577abc3cda4dd448808957b5b1966140f53ab94cd0530a08e7d68b0f93a7d476b3849c9c6fdaa03596bb609782ce89717fb5e61dbb555b7c61ddd3c3a31df4ed636115adbfdfe444d31aa0877ab583918b9ee9ed53e33519d81254d8e644790d3c0fe0b34685ad7faa583eb97c646cc26ae2fd67add71bca70cefd31f59e3433502c4f27309b4cad267cd218c1e03b8f0d55255db40cfdf9964e8511366d752f10acf171bcaf9178a1f2ac9f0b00a69603c4af48f28aa1257329a316b169986d308845450ef01cd1626f121c46c6cb7eee5191446dee748f7c545a3fa3b7e9fb75d574caad7e37a253613600087bbdc1c24269448825ba551fb734d7bb51ebdc1fd28fd78dd33b66db9090605732e1a9335f65d2ad188bc175b0236fc441dedd1edd170e5cff2d4176025b8a18bb99d47b1d264c9e386541f07ea4d066d5d88f41e07a3f4a7ec98b2f756017f8ae8c88678f1405b12d24ececb31f90fa97d112cf95fd7285d36e69e70dadf82f24337e2c1f5392ab4455261a1c4552229867b3ba273195c39a0efe4724ef82c3e83b54c0e4cd65e0eb2367ba6327fd1ccdef8144e57e9fd0c1fee6c3ffc4b8b94ab9d8d02b20c09cb2b7826ad3eb0691cacff57691d29acee82fe4bdc447a9a211a15ca6ddc01031dcf2537e68d8a051d3926b925f249b99357e7f72b1ad49b1ae0b36985b2706b323e89f1e4d6424691eedaa2f781af8c6d2fdd25f1ad854a0e2987e3f8db3db775a285bdd0bd53d8149beaf14c9fff650a9a2d22e851ca75010fb6b454888bb829fc346e08e5659305ae75cb5dca8a599cdf238e083f17d4ba7351ffee00eabb333b75d2446058c524572617f28747a9412aa0c73f7f3154f7d577bd76d9f909e1a6919eb26546ac3ea088b80d225570cfb41960dcd3730ad8c31bd9dcb021e8df02e54244d9b2a6c6467f9d5294ccdcf53881836de5160b96d8959ff96f9b1b57ea4e99990a4dd2c7e2bb1280afe8fb2d199a3799280b0ac99eeb63f00e0a7f683b4271557e142b4b64a1e6b3b1440c1abec469ef880769b805764d0ec6346e6104aacecafeb09f8188c0936ca9e5c92c24c22c41b4aa8d76d3b67408afed40c807d0c9ea46c5a5997ccbb25f650f85d48bf8df0c7f5dcc6a35e73dd94b36b64b04433e7daca8670174094f6bd31abc921a4f4b041737e386b77efea01c22be8781bd88b3292a703d40764242e9a0afb3cc57405cdc52bb1c16131276d99feaee531a7f66396696be8226ef36cfea38a4b2c0cc2d0f9a9079b1ec17f336577c9dce8b37c1ee6363b0ab40503b43c3df0784aea64aba99e733984dc5f2a152f56d25e6a5dcd4dc5f6aef33a6693b98e44c80ce9c5d0b0f5386cb2ca6fa494dc25d10ec04682debeba4c07da1ae936ad40a0c124d542cfe6dfd5412aa267518ab67e1d8b18cf1d13ed93c199283fd00e5e8c60efa5db565efe362bfb6902e63a072b141db4a2a7b5c444f64b09e2f3f36d4ebcb768cf8629e6479e3b9eb295c5476d45d709fd90265ca39f66455afb53ee76d42fc12fb0f0d6927a4ce822d3a810212e478735fc8d4d93f4421b5f8ba2582136736e3f1ba4857c9300a30e8608df72ded02f0326b4274752ee1636b3dfb07bc2352e0db87ff33b7e6e9e92c2002800e1324d1859e15fd6929a3d1a3bc9d761befd733344347c6c6ef87e26e6995466200b8e649a276ef7c803bec2755c6e3b5a2c5000dac6c05739c79156a1c168ddef6c12servicerootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootdocker-stable-24.0.9_ce-150000.1.39.1.src.rpmconfig(docker-stable)dockerdocker-libnetworkdocker-stabledocker-stable(ppc-64)group(docker)user(dockremap)   @@@@@@@@@@@       (apparmor-parser or container-selinux)/bin/sh/bin/sh/bin/sh/bin/shca-certificates-mozillacatatonitconfig(docker-stable)containerdcoreutilsdiffutilse2fsprogsfillupgrepiproute2iptableslibc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libdevmapper.so.1.03()(64bit)libdevmapper.so.1.03(Base)(64bit)libdevmapper.so.1.03(DM_1_02_97)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.17)(64bit)libresolv.so.2()(64bit)libresolv.so.2(GLIBC_2.17)(64bit)libsystemd.so.0()(64bit)libsystemd.so.0(LIBSYSTEMD_209)(64bit)procpsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)rpmlib(RichDependencies)runcshadowshadowsysuser-shadowtarudevxz24.0.9_ce-150000.1.39.11.7.33.51.43.0.4-14.6.0-14.0-15.2-14.12.0-11.1.91.264.9docker4.14.1i@io@i&h^hth@hxhAh@5@ggg@gg@gb@gaggY~gY~gG g=@g3C@ggf@@f@fne̫@e;@e&@ed@d@d@dr@dddjdJcdI@cT@c.cV~@c5c5bz@bb>b=bk@bX aZ@a@@a]aHw``x*`?z@`)`#``>`>``_1@_@_S_#_d@_'@^)@^^?@]f@]+]@]҇]]z@]?]b@]@1@]:@]5@]/ ]@]\Q\!\-@\@\@\u*@\^\Z@\Yz\8@\2\@\[[F[s[s[@[}P@[{[{[ug@[a[`O@[^[6@[{@[{@[{@[ @Z@ZJ@Z̧@Za@Zľ@Z2@Z%Z@ZZ|;Zp^@Zo Zk@ZaZaZ7Z7Z&@Z%8ZZ@Z Z@Z@Y+@Y@YdY*@Y˒YY@YYYoIYoIYdY_wY^&@YGY-^Y, @Y;@YR@YY Y#@XXh@XXXX@X@X@XX@XO@XO@XO@XXX6@XXx@Xv@XY@XY@XWXEVX=mX6@X@Ww@W@W@W;WҤ@W@WίWiWiWu@W#W/@W/@W/@W/@WW@W:W:W:W@W@W@W-@W{@W{@Wm WXW>@W=W to remove strings.Split and add parseToken function, bsc#1240513 fixes CVE-2025-30204 + 0017-CVE-2025-30204-fix-Remove-strings.Split-and-add-pars.patch- Backport to fix incorrect permissions for overlayfs lowerdir. In practice the permissions of this directory are immaterial but some security scanners falsely flag this as an issue. bsc#1254206 + 0016-daemon-overlay2-remove-world-writable-permission-fro.patch- Enable SELinux in default daemon.json config (--selinux-enabled). This has no practical impact on non-SELinux systems. bsc#1252290- Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508 This feature is mostly intended for developers ("docker build git://") so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install). - Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. bsc#1250596- Backport . bsc#1247362 + 0015-bsc1247362-release-container-layer-on-export.patch- Update to docker-buildx v0.25.0. Upstream changelog: - Update to Go 1.23 for building now that upstream has switched their 23.0.x LTSS to use Go 1.23.- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150 * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch - Rebase patches: * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0007-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch * 0008-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0009-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0010-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch * 0011-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch * 0012-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch * 0013-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch * 0014-TESTS-backport-fixes-for-integration-tests.patch- Always clear SUSEConnect suse_* secrets when starting containers regardless of whether the daemon was built with SUSEConnect support. Not doing this causes containers from SUSEConnect-enabled daemons to fail to start when running with SUSEConnect-disabled (i.e. upstream) daemons. This was a long-standing issue with our secrets support but until recently this would've required migrating from SLE packages to openSUSE packages (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move away from in-built SUSEConnect support, this is now a practical issue users will run into. bsc#1244035 + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch - Rearrange patches: - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch + 0007-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch - 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch + 0008-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch + 0009-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch + 0010-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch + 0011-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch + 0012-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch + 0013-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - 0013-TESTS-backport-fixes-for-integration-tests.patch + 0014-TESTS-backport-fixes-for-integration-tests.patch- Update to docker-buildx v0.22.0. Upstream changelog: * Includes fixes for CVE-2025-0495. bsc#1239765- Disable transparent SUSEConnect support for SLE-16. PED-12534 When this patchset was first added in 2013 (and rewritten over the years), there was no upstream way to easily provide SLE customers with a way to build container images based on SLE using the host subscription. However, with docker-buildx you can now define secrets for builds (this is not entirely transparent, but we can easily document this new requirement for SLE-16). Users should use RUN --mount=type=secret,id=SCCcredentials zypper -n ... in their Dockerfiles, and docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file . when doing their builds. - Now that the only blocker for docker-buildx support was removed for SLE-16, enable docker-buildx for SLE-16 as well. PED-8905- Don't use the new container-selinux conditional requires on SLE-12, as the RPM version there doesn't support it. Arguably the change itself is a bit suspect but we can fix that later. bsc#1237367- Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0011-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0012-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch * 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Move test-related patch to the end of the patch stack: - 0011-TESTS-backport-fixes-for-integration-tests.patch + 0013-TESTS-backport-fixes-for-integration-tests.patch- Make container-selinux requirement conditional on selinux-policy (bsc#1237367)- Add backport for CVE-2024-29018 fix. bsc#1234089 + 0010-CVE-2024-29018-libnet-Don-t-forward-to-upstream-reso.patch - Add backport for CVE-2024-23650 fix and rename patch filename. bsc#1219437 - 0006-CVE-2024-23653-update-buildkit-to-include-CVE-patche.patch + 0006-CVE-2024-2365x-update-buildkit-to-include-CVE-patche.patch - Reorder and rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - 0010-TESTS-backport-fixes-for-integration-tests.patch + 0011-TESTS-backport-fixes-for-integration-tests.patch- Update to docker-buildx 0.19.3. See upstream changelog online at - Update docker-buildx to v0.19.2. See upstream changelog online at . Some notable changelogs from the last update: * * - Update to Go 1.22.- Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch- Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819- Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Rebased patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-CVE-2024-23653-update-buildkit-to-include-CVE-patche.patch * 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch - Added patches: + 0010-TESTS-backport-fixes-for-integration-tests.patch- Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Update --add-runtime to point to correct binary path.- Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles.- Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at - Import specfile changes for docker-buildx as well as the changes to help reduce specfile differences between docker-stable and docker. bsc#1230331 bsc#1230333- Backport patch for CVE-2024-41110. bsc#1228324 + 0009-CVE-2024-41110-AuthZ-plugin-securty-fixes.patch- Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference. - Patches included from snapshot: + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch + 0006-CVE-2024-23653-update-buildkit-to-include-CVE-patche.patch + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.9-ce, which is the latest version of the 24.0.x branch. It seems likely this will be the last upstream version of the 24.0.x branch (it seems Mirantis is going to do LTS for 23.0.x, not 24.0.x). - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of and . bsc#1221916 + 0007-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of . bsc#1214855 + 0008-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch- Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings- Update to Docker 24.0.7-ce. See upstream changelog online at . bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch- Update to Docker 24.0.6-ce. See upstream changelog online at . bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141- Update to Docker 24.0.5-ce. See upstream changelog online at . bsc#1213229- Update to Docker 24.0.4-ce. See upstream changelog online at . bsc#1213500- Update to Docker 24.0.3-ce. See upstream changelog online at . bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch- Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function.- Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless)- Update to Docker 24.0.2-ce. See upstream changelog online at . bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch- Update to Docker 23.0.6-ce. See upstream changelog online at . bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`- Update to Docker 23.0.5-ce. See upstream changelog online at . - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch- Update to Docker 23.0.4-ce. See upstream changelog online at . bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch- update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch- Update to Docker 20.10.21-ce. See upstream changelog online at . bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users.- Fix wrong After: in docker.service, fixes bsc#1188447- Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux.- Fix syntax of boolean dependency- Allow to install container-selinux instead of apparmor-parser.- Change to using systemd-sysusers- Backport to fix a crash-on-start issue with dockerd. bsc#1200022 + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch- Update to Docker 20.10.17-ce. See upstream changelog online at . bsc#1200145 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191. bsc#1193930 bsc#1197284 * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch- Update to Docker 20.10.14-ce. See upstream changelog online at . bsc#1197517 CVE-2022-24769- Update to Docker 20.10.12-ce. See upstream changelog online at . - Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the changelogs are currently only available online.- Update to Docker 20.10.11-ce. See upstream changelog online at . bsc#1192814 bsc#1193273 CVE-2021-41190 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - Remove upstreamed patches: - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch- Update to Docker 20.10.9-ce. See upstream changelog online at . bsc#1191355 CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434 CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch - Switch to Go 1.16.x compiler, in line with upstream.- Add patch to return ENOSYS for clone3 to avoid breaking glibc again. bsc#1190670 + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch- Add shell requires for the *-completion subpackages.- Update to Docker 20.10.6-ce. See upstream changelog online at . bsc#1184768 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Backport upstream fix for btrfs quotas being removed by Docker regularly. bsc#1183855 bsc#1175081 + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch- Update to Docker 20.10.5-ce. See upstream changelog online at . bsc#1182947 - Update runc dependency to 1.0.0~rc93. - Remove upstreamed patches: - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Switch version to use -ce suffix rather than _ce to avoid confusing other tools. boo#1182476[NOTE: This update was only ever released in SLES and Leap.] - It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop the patch entirely. bsc#1180401 bsc#1182168 - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch- Fix incorrect cast in SUSE secrets patches causing warnings on SLES. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch[NOTE: This update was only ever released in SLES and Leap.] - Update Docker to 19.03.15-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285). - Rebase patches: * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch - Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE. It appears that SLES doesn't like the patch. bsc#1180401- Update to Docker 20.10.3-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285). - Rebase patches on top of 20.10.3-ce. - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use the upstream runc package (it's stable enough and Docker no longer pins git versions). docker-libnetwork is so unstable that it doesn't have any versioning scheme and so it really doesn't make sense to maintain the project as a separate package. bsc#1181641 bsc#1181677 - Remove no-longer-needed patch for packaging now that we've dropped docker-runc and docker-libnetwork. - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch- Update to Docker 20.10.2-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594 - Remove upstreamed patches: - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch - Add patches to fix build: + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch - Since upstream has changed their source repo (again) we have to rebase all of our patches. While doing this, I've collapsed all patches into one branch per-release and thus all the patches are now just one series: - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch - secrets-0002-SUSE-implement-SUSE-container-secrets.patch + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch - private-registry-0001-Add-private-registry-mirror-support.patch + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it was fixed. * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Add Conflicts and Provides for kubic flavour of docker-fish-completion.- Update to Docker 19.03.14-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243 https://github.com/docker/docker-ce/releases/tag/v19.03.14- Enable fish-completion- Add a patch which makes Docker compatible with firewalld with nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548 (boo#1178801, SLE-16460) * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch- Update to Docker 19.03.13-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)- Emergency fix: %requires_eq does not work with provide symbols, only effective package names. Convert back to regular Requires.- Update to Docker 19.03.12-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of spurrious errors due to Go returning -EINTR from I/O syscalls much more often (due to Go 1.14's pre-emptive goroutine support). - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch - Add BuildRequires for all -git dependencies so that we catch missing dependencies much more quickly.- Update to Docker 19.03.11-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401 - Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we can build Docker with Go 1.14 (upstream uses Go 1.13). + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch- BuildRequire pkgconfig(libsystemd) instead of systemd-devel: Allow OBS to shortcut through the -mini flavors.- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469 + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch- Support older SLE systems which don't have "usermod -w -v".- Update to Docker 19.03.5-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1158590 bsc#1157330- Update to Docker 19.03.4-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.- Drop containerd.service workaround (we've released enough versions without containerd.service -- there's no need to support package upgrades that old). - Update to Docker 19.03.3-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1153367- Update to Docker 19.03.2-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1150397- Fix zsh-completion (docker -> _docker)- Fix default installation such that --userns-remap=default works properly (this appears to be an upstream regression, where --userns-remap=default doesn't auto-create the group and results in an error on-start). boo#1143349- Update to Docker 19.03.1-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2019-14271- Update to Docker 19.03.0-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1142413 - Remove upstreamed patches: - bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch - bsc1001161-0002-cli-add-a-separate-domainname-flag.patch - bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch - bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch - Rebase pacthes: * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch * packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch * private-registry-0001-Add-private-registry-mirror-support.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Move bash-completion to correct location. - Update to Docker 18.09.8-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. * Includes fixes for CVE-2019-13509 bsc#1142160.- Update to Docker 18.09.7-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1139649 - Remove upstreamed patches: - CVE-2018-15664.patch- Use %config(noreplace) for /etc/docker/daemon.json. bsc#1138920- Add patch for CVE-2018-15664. bsc#1096726 + CVE-2018-15664.patch- Update to Docker 18.09.6-ce see upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. - Rebase patches: * bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch- Update to Docker 18.09.5-ce see upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1128376 boo#1134068 - Rebase patches: * bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch * bsc1001161-0002-cli-add-a-separate-domainname-flag.patch * bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch * bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch * packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch * private-registry-0001-Add-private-registry-mirror-support.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Updated patch name: + bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch - bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch- Update to Docker 18.09.3-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.- docker-test: improvements to test packaging (we don't need to ship around the entire source tree, and we also need to build the born-again integration/ tests which contain a suite-per-directory). We also need a new patch which fixes the handling of *-test images. bsc#1128746 + bsc1128746-0001-integration-cli-don-t-build-test-images-if-they-alre.patch- Move daemon.json file to /etc/docker directory, bsc#1114832- Update shell completion to use Group: System/Shells.- Add daemon.json file with rotation logs cofiguration, bsc#1114832- Update to Docker 18.09.1-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1124308 * Includes fix for CVE-2018-10892 bsc#1100331. * Includes fix for CVE-2018-20699 bsc#1121768. - Remove upstreamed patches. - bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch- Disable leap based builds for kubic flavor. bsc#1121412- Update go requirements to >= go1.10.6 to fix * bsc#1118897 CVE-2018-16873 go#29230 cmd/go: remote command execution during "go get -u" * bsc#1118898 CVE-2018-16874 go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths * bsc#1118899 CVE-2018-16875 go#29233 crypto/x509: CPU denial of service- Handle build breakage due to missing 'export GOPATH' (caused by resolution of boo#1119634). I believe Docker is one of the only packages with this problem.- Add backports of https://github.com/docker/docker/pull/37302 and https://github.com/docker/cli/pull/1130, which allow for users to explicitly specify the NIS domainname of a container. bsc#1001161 + bsc1001161-0001-oci-include-the-domainname-in-kernel.domainname.patch + bsc1001161-0002-cli-add-a-separate-domainname-flag.patch- Update docker.service to match upstream and avoid rlimit problems. bsc#1112980 - Upgrade to Docker 18.09.0-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. boo#1115464 bsc#1118990 - Add revert of an upstream patch to fix docker-* handling. + packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch - Rebase patches: * bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch * bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch * bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch * private-registry-0001-Add-private-registry-mirror-support.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Remove upstreamed patches: - bsc1100727-0001-build-add-buildmode-pie.patch- Reduce the disk footprint by recommending git-core instead of hard requiring it. bsc#1108038- ExcludeArch i586 for entire docker-kubic flavour- ExcludeArch i586 for docker-kubic-kubeadm-criconfig subpackage- Add patch to make package reproducible, which is a backport of https://github.com/docker/cli/pull/1306. boo#1047218 + bsc1047218-0001-man-obey-SOURCE_DATE_EPOCH-when-generating-man-pages.patch- Upgrade to docker-ce v18.06.1-ce. bsc#1102522 bsc#1113313 Upstream changelog: https://github.com/docker/docker-ce/releases/tag/v18.06.1-ce - Remove patches that were merged upstream: - bsc1102522-0001-18.06-disable-containerd-CRI-plugin.patch- Add a backport of https://github.com/docker/engine/pull/29 for the 18.06.0-ce upgrade. This is a potential security issue (the CRI plugin was enabled by default, which listens on a TCP port bound to 0.0.0.0) that will be fixed upstream in the 18.06.1-ce upgrade. bsc#1102522 + bsc1102522-0001-18.06-disable-containerd-CRI-plugin.patch- Kubic: Make crio default, docker as alternative runtime (boo#1104821) - Provide kubernetes CRI config with docker-kubic-kubeadm-criconfig subpackage- Merge -kubic packages back into the main Virtualization:containers packages. This is done using _multibuild to add a "kubic" flavour, which is then used to conditionally compile patches and other kubic-specific features. bsc#1105000 - Rework docker-rpmlintrc with the new _multibuild setup.- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage to work with Docker and containerd. fate#325877- Upgrade to docker-ce v18.06.0-ce. bsc#1102522 - Remove systemd-service dependency on containerd, which is now being started by dockerd to align with upstream defaults. - Removed the following patches as they are merged upstream: - bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch - bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch - Rebased the following patches: * bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch * bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch * bsc1100727-0001-build-add-buildmode-pie.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Build the client binary with -buildmode=pie to fix issues on POWER. bsc#1100727 + bsc1100727-0001-build-add-buildmode-pie.patch- Update the AppArmor patchset again to fix a separate issue where changed AppArmor profiles don't actually get applied on Docker daemon reboot. bsc#1099277 * bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch + bsc1073877-0002-apparmor-clobber-docker-default-profile-on-start.patch- Update to AppArmor patch so that signal mediation also works for signals between in-container processes. bsc#1073877 * bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch- Make use of %license macro- Remove 'go test' from %check section, as it has only ever caused us problems and hasn't (as far as I remember) ever caught a release-blocking issue. Smoke testing has been far more useful. boo#1095817- Update secrets patch to not log incorrect warnings when attempting to inject non-existent host files. bsc#1065609 * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Review Obsoletes to fix bsc#1080978- Put docker under the podruntime slice. This the recommended deployment to allow fine resource control on Kubernetes. bsc#1086185- Add patch to handle AppArmor changes that make 'docker kill' stop working. bsc#1073877 boo#1089732 + bsc1073877-0001-apparmor-allow-receiving-of-signals-from-docker-kill.patch- Fix manpage generation breaking ppc64le builds due to a missing - buildemode=pie.- Compile and install all manpages. bsc#1085117- Add requirement for catatonit, which provides a docker-init implementation. fate#324652 bsc#1085380- Fix private-registry-0001-Add-private-registry-mirror-support.patch to deal corretly with TLS configs of 3rd party registries. fix bsc#1084533- Update patches to be sourced from https://github.com/suse/docker-ce (which are based on the upstream docker/docker-ce repo). The reason for this change (though it is functionally identical to the old patches) is so that public patch maintenance is much simpler. * bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch * bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch * private-registry-0001-Add-private-registry-mirror-support.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Add ${version} to equivalent non-kubic package provides- Add Provides for equivalent non-kubic packages- Disable all tests for docker/client and docker/pkg/discovery. The unit tests of those packages broke reproducibly the builds in IBS.- Disable flaky tests github.com/docker/docker/pkg/discovery/kv.- Add patch to support mirroring of private/non-upstream registries. As soon as the upstream PR (https://github.com/moby/moby/pull/34319) is merged, this patch will be replaced by the backported one from upstream. + private-registry-0001-Add-private-registry-mirror-support.patch fix bsc#1074971- Add Obsoletes: docker-image-migrator, as the tool is no longer needed and we've pretty much removed it from everywhere except the containers module. bsc#1069758- Remove requirement on bridge-utils, which has been replaced by libnetwork in Docker. bsc#1072798- Update to Docker v17.09.1_ce (bsc#1069758). Upstream changelog: https://github.com/docker/docker-ce/releases/tag/v17.09.1-ce - Removed patches (merged upstream): - bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch - bsc1066210-0001-vendor-update-to-github.com-vbatts-tar-split-v0.10.2.patch - bsc1066801-0001-oci-add-proc-scsi-to-masked-paths.patch- Update to Docker v17.09.0_ce. Upstream changelog: https://github.com/docker/docker-ce/releases/tag/v17.09.0-ce - Rebased patches: * bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch * bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch * bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch - Removed patches (merged upstream): - bsc1064781-0001-Allow-to-override-build-date.patch- Add a patch to dynamically probe whether libdevmapper supports dm_task_deferred_remove. This is necessary because we build the containers module on a SLE12 base, but later SLE versions have libdevmapper support. This should not affect openSUSE, as all openSUSE versions have a new enough libdevmapper. Backport of https://github.com/moby/moby/pull/35518. bsc#1021227 bsc#1029320 bsc#1058173 + bsc1021227-0001-pkg-devmapper-dynamically-load-dm_task_deferred_remo.patch- Fix up the ordering of tests in docker.spec. This is to keep things easier to backport into the SLE package.- Include secrets fix to handle "old" containers that have orphaned secret data. It's not clear why Docker caches these secrets, but fix the problem by trashing the references manually. bsc#1057743 * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- Remove migration code for the v1.9.x -> v1.10.x migration. This has been around for a while, and we no longer support migrating from such an old version "nicely". Docker still has migration code that will run on first-boot, we are merely removing all of the "nice" warnings which tell users how to avoid issues during an upgrade that ocurred more than a year ago. - Drop un-needed files: - docker-plugin-message.txt - docker-update-message.txt- Add a backport of https://github.com/moby/moby/pull/35424, which fixes a security issue where a maliciously crafted image could be used to crash a Docker daemon. bsc#1066210 CVE-2017-14992 + bsc1066210-0001-vendor-update-to-github.com-vbatts-tar-split-v0.10.2.patch- Add a backport of https://github.com/moby/moby/pull/35399, which fixes a security issue where a Docker container (with a disabled AppArmor profile) could write to /proc/scsi/... and subsequently DoS the host. bsc#1066801 CVE-2017-16539 + bsc1066801-0001-oci-add-proc-scsi-to-masked-paths.patch- Correctly set `docker version` information, including the version, git commit, and SOURCE_DATE_EPOCH (requires a backport). This should * effectively* make Docker builds reproducible, with minimal cost. boo#1064781 + bsc1064781-0001-Allow-to-override-build-date.patch- Add backport of https://github.com/moby/moby/pull/35205. This used to be fixed in docker-runc, but we're moving it here after upstream discussion. bsc#1055676 + bsc1055676-0001-daemon-oci-obey-CL_UNPRIVILEGED-for-user-namespaced-.patch- Update to Docker v17.07.0_ce. Upstream changelog: https://github.com/docker/docker-ce/releases/tag/v17.06.0-ce https://github.com/docker/docker-ce/releases/tag/v17.07.0-ce - Removed no-longer needed patches. - bsc1037436-0001-client-check-tty-before-creating-exec-job.patch - bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch - integration-cli-fix-TestInfoEnsureSucceeds.patch - Added backport of https://github.com/moby/moby/pull/34573. bsc#1045628 + bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch - Rewrite secrets patches to correctly handle directories in a way that doesn't cause errors when starting new containers. * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Fix bsc#1059011 The systemd service helper script used a timeout of 60 seconds to start the daemon, which is insufficient in cases where the daemon takes longer to start. Instead, set the service type from 'simple' to 'notify' and remove the now superfluous helper script.- fix bsc#1057743: Add a Requires: fix_bsc_1057743 which is provided by the newer version of docker-libnetwork. This is necessary because of a versioning bug we found in bsc#1057743.- fix /var/adm/update-message/docker file name to be /var/adm/update-message/docker-%{version}-%{release}- devicemapper: add patch to make the dm storage driver remove a container's rootfs mountpoint before attempting to do libdm operations on it. This helps avoid complications when live mounts will leak into containers. Backport of https://github.com/moby/moby/pull/34573. bsc#1045628 + bsc1045628-0001-devicemapper-remove-container-rootfs-mountPath-after.patch- Fix a regression in our SUSE secrets patches, which caused the copied files to not carry the correct {uid,gid} mapping when using user namespaces. This would not cause any bugs (SUSEConnect does the right thing anyway) but it's possible some programs would not treat the files correctly. This is tangentially related to bsc#1055676. * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Use -buildmode=pie for tests and binary build. bsc#1048046 bsc#1051429- enable deferred removal for sle12sp2 and newer (and openSUSE equivalent. fix bsc#1021227- enable libseccomp on sle12sp2 and newer, 42.2 and newer fix bsc#1028638 - docker: conditional filtering not supported on libseccomp for sle12- add SuSEfirewall2.service to the After clause in docker.service in order to fix bsc#1046024- fix path to docker-runc in systemd service file- change dependency to docker-runc- Fix bsc#1029630: docker does not wait for lvm on system startup I added "lvm2-monitor.service" as an "After dependency" of the docker systemd unit.- Fix bsc#1032287: missing docker systemd configuration- Update SUSE secrets patch to correctly handle restarting of containers. + secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch + secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Fix bsc#1037607 which was causing read-only issues on Kubic, this is a backport of https://github.com/moby/moby/pull/33250. + bsc1037607-0001-apparmor-make-pkg-aaparser-work-on-read-only-root.patch- Fix bsc#1038476 warning about non-executable docker * Simply verify we have binary prior using it, might happen if someone had docker installed and then did remove it and install from scratch again- Add a partial fix for boo#1038493. - Fixed bsc#1037436 where execids were being leaked due to bad error handling. This is a backport of https://github.com/docker/cli/pull/52. + bsc1037436-0001-client-check-tty-before-creating-exec-job.patch- Fix golang requirements in the subpackages- Update golang build requirements to use golang(API) symbol: this is needed to solve a conflict between multiple versions of Go being available- Fix secrets-0002-SUSE-implement-SUSE-container-secrets.patch: substitute docker/distribution/digest by opencontainers/digest- Update to version 17.04.0-ce (fix bsc#1034053 ) - Patches removed because have been merged into this version: * pr31549-cmd-docker-fix-TestDaemonCommand.patch * pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch - Patches rebased: * integration-cli-fix-TestInfoEnsureSucceeds.patch - Build man pages for all archs (bsc#953182) - Containers cannot resolve DNS if docker host uses 127.0.0.1 as resolver (bsc#1034063) see /usr/share/doc/packages/docker/CHANGELOG.md- Make sure this is being built with go 1.7- remove the go_arches macro because we are using go1.7 which is available in all archs - remove gcc specific patches * gcc-go-patches.patch * netlink_netns_powerpc.patch * boltdb_bolt_add_brokenUnaligned.patch- Enable Delegate=yes, since systemd will safely ignore lvalues it doesn't understand.- Update SUSE secrets patch to handle boo#1030702. * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch * secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Fix (bsc#1032644) Change lvm2 from Requires to Recommends Docker usually uses a default storage driver, when it's not configured explicitly. This default driver then depends on the underlying system and gets chosen during installation.- Disable libseccomp for leap 42.1, sle12sp1 and sle12, because docker needs a higher version. Otherwise, we get the error "conditional filtering requires libseccomp version >= 2.2.1 (bsc#1028639 and bsc#1028638)- Add a backport of fix to AppArmor lazy loading docker-exec case. https://github.com/docker/docker/pull/31773 + pr31773-daemon-also-ensureDefaultApparmorProfile-in-exec-pat.patch- Clean up docker-mount-secrets.patch to use the new swarm secrets internals of Docker 1.13.0, which removes the need to implement any secret handling ourselves. This resulted in a split up of the patch. - docker-mount-secrets.patch + secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch + secrets-0002-SUSE-implement-SUSE-container-secrets.patch- Remove old plugins.json to prevent docker-1.13 to fail to start- Fix bsc#1026827: systemd TasksMax default throttles docker- Fix post section by adding shadow as a package requirement Otherwise the groupadd instruction fails- Add patch to fix TestDaemonCommand failure in %check. This is an upstream bug, and has an upstream PR to fix it https://github.com/docker/docker/pull/31549. + pr31549-cmd-docker-fix-TestDaemonCommand.patch- update docker to 1.13.0 see details in https://github.com/docker/docker/releases/tag/v1.13.0 - use the same buildflags for building docker and for building the tests. - enable pkcs11: https://github.com/docker/docker/commit/37fa75b3447007bb8ea311f02610bb383b0db77f- enable architecture s390x for openSUSE- provide the oci runtime so that containers which were using an old runtime option, when started on the new docker version, the runtime is changed to the new one. fix bsc#1020806 bsc#1016992- fix CVE-2016-9962 bsc#1012568 . Fix it by updating to 1.12.6 plus an extra commit to fix liverestore: https://github.com/docker/docker/commit/97cd32a6a9076306baa637a29bba84c3f1f3d218- add "a wait" when starting docker service to fix bsc#1019251- remove netlink_gcc_go.patch after integration of PR https://github.com/golang/go/issues/11707 - new boltdb_bolt_add_brokenUnaligned.patch for ppc64 waiting for https://github.com/boltdb/bolt/pull/635- Remove old flags from dockerd's command-line, to be more inline with upstream (now that docker-runc is provided by the runc package). -H is dropped because upstream dropped it due to concerns with socket activation. - Remove socket activation entirely.- update docker to 1.12.5 (bsc#1016307). This fixes bsc#1015661- fix bash-completion- Add packageand(docker:bash) to bash-completion to match zsh-completion.- fix runc and containerd revisions fix bsc#1009961- update docker to 1.12.3 - fix bsc#1007249 - CVE-2016-8867: Fix ambient capability usage in containers - other fixes: https://github.com/docker/docker/releases/tag/v1.12.3- update docker to 1.12.2 (bsc#1004490). See changelog https://github.com/docker/docker/blob/v1.12.2/CHANGELOG.md - update docker-mount-secrets.patch to 1.12.2 code- docker-mount-secrets.patch: change the internal mountpoint name to not use ":" as that character can be considered a special character by other tools. bsc#999582- fix go_arches definition: use global instead of define, otherwise it fails to build- Add dockerd(8) man page.- add missing patch to changelog- fix integration test case - add integration-cli-fix-TestInfoEnsureSucceeds.patch- update rpmlintrc- make test timeout configurable- Remove noarch from docker-test, which was causing lots of fun issues when trying to run them.- Fix build for ppc64le: use static libgo for dockerd and docker-proxy as in docker build.- Update docker to 1.12.1 (bsc#996015) see changelog in https://github.com/docker/docker/releases/tag/v1.12.1- Add asaurin@suse.com's test.sh test script. - Add integration test binary in docker.spec file. This is work done by asaurin@suse.com.- Package docker-proxy (which was split out of the docker binary in 1.12). boo#995620- fix bsc#995102 - Docker "migrator" prevents installing "docker", if docker 1.9 was installed before but there were no images- Update docker.service file with several changes. * Reapply fix for bsc#983015 (Limit*=infinity). * Specify an "OCI" runtime for our runc package explicitly. bsc#978260- remove disable-pprof-trace.patch: We can remove this patch because we use go 1.6, either gcc6-go or gc-go. This patch was for gcc5-go- add go_arches in project configuration: this way, we can use the same spec file but decide in the project configuration if to use gc-go or gcc-go for some archs.- use gcc6-go instead of gcc5-go (bsc#988408) - build ppc64le with gc-go because this version builds with gc-go 1.6 - remove bnc964673-boltdb-metadata-recovery.patch because it has already been merged- update to v1.12.0 (bsc#995058) see detailed changelog at https://github.com/docker/docker/releases/tag/v1.12.0 - disable test that fail in obs build context - only run unit tests on architectures that provide the go list and go test tools - disable dockerd, parser, integration test, and devicemapper related tests on versions below SLE12 and openSUSE_13.2 - bump test timeout to 10m (for aarch64) - run unit tests during the build - Adapt docker.service file. - adapt install sections for gccgo builds: gccgo build are not built in separate folders for client and daemon. They both reside in dyngccgo. - gcc-go-patch: link against systemd when compiling the daemon. - Add disable-pprof-trace.patch pprof.Trace() is not available in go version <= 1.4 which we use to build SLES packages. This patch comments out the pprof.Trace() section. - update gcc-go-patch and docker-mount-secrets.patch- Fixed binary split, install both required binaries correctly* Explicitly state the version dependencies for runC and containerd, to avoid potential issues with incompatible component versions. These must be updated *each time we do a release*. bsc#993847- Don't exit mid install, add the ability to not restart the docker service during certain updates with long migration phases bsc#980555- remove kernel dependency (bsc#987198)- remove sysconfig.docker.ppc64le patch setting iptables option on ppc64le works now (bsc#988707)- fix bsc#984942: audit.rules in docker-1.9.1-58.1.x86_64.rpm has a syntax error* Update docker.service to include changes from upstream, including the soon-to-be-merged patch https://github.com/docker/docker/pull/24307, which fixes bnc#983015.- readd dropped declaration for patch200* Removed patches: - cve-2016-3697-numeric-uid.patch (merged upstream in gh@docker/docker#22998). * Update Docker to 1.11.2. (bsc#989566) Changelog from upstream: * Networking * Fix a stale endpoint issue on overlay networks during ungraceful restart (#23015) * Fix an issue where the wrong port could be reported by docker inspect/ps/port (#22997) * Runtime * Fix a potential panic when running docker build (#23032) * Fix interpretation of --user parameter (#22998) * Fix a bug preventing container statistics to be correctly reported (#22955) * Fix an issue preventing container to be restarted after daemon restart (#22947) * Fix issues when running 32 bit binaries on Ubuntu 16.04 (#22922) * Fix a possible deadlock on image deletion and container attach (#22918) * Fix an issue where containers fail to start after a daemon restart if they depend on a containerized cluster store (#22561) * Fix an issue causing docker ps to hang on CentOS when using devicemapper (#22168, #23067) * Fix a bug preventing to docker exec into a container when using devicemapper (#22168, #23067)- Fix udev files ownership- Pass over with spec-cleaner, no factual changes* Make sure we *always* build unstripped Go binaries.* Add a patch to fix database soft corruption issues if the Docker dameon dies in a bad state. There is a PR upstream to vendor Docker to have this fix as well, but it probably won't get in until 1.11.2. bnc#964673 (https://github.com/docker/docker/pull/22765) + bnc964673-boltdb-metadata-recovery.patch* Remove conditional Patch directive for SUSE secrets, since conditionally including patches results in incompatible .src.rpms. The patch is still applied conditionally.* Update to Docker 1.11.1. Changelog from upstream: * Distribution - Fix schema2 manifest media type to be of type `application/vnd.docker.container.image.v1+json` ([#21949](https://github.com/docker/docker/pull/21949)) * Documentation + Add missing API documentation for changes introduced with 1.11.0 ([#22048](https://github.com/docker/docker/pull/22048)) * Builder * Append label passed to `docker build` as arguments as an implicit `LABEL` command at the end of the processed `Dockerfile` ([#22184](https://github.com/docker/docker/pull/22184)) * Networking - Fix a panic that would occur when forwarding DNS query ([#22261](https://github.com/docker/docker/pull/22261)) - Fix an issue where OS threads could end up within an incorrect network namespace when using user defined networks ([#22261](https://github.com/docker/docker/pull/22261)) * Runtime - Fix a bug preventing labels configuration to be reloaded via the config file ([#22299](https://github.com/docker/docker/pull/22299)) - Fix a regression where container mounting `/var/run` would prevent other containers from being removed ([#22256](https://github.com/docker/docker/pull/22256)) - Fix an issue where it would be impossible to update both `memory-swap` and `memory` value together ([#22255](https://github.com/docker/docker/pull/22255)) - Fix a regression from 1.11.0 where the `/auth` endpoint would not initialize `serveraddress` if it is not provided ([#22254](https://github.com/docker/docker/pull/22254)) - Add missing cleanup of container temporary files when cancelling a schedule restart ([#22237](https://github.com/docker/docker/pull/22237)) - Removed scary error message when no restart policy is specified ([#21993](https://github.com/docker/docker/pull/21993)) - Fix a panic that would occur when the plugins were activated via the json spec ([#22191](https://github.com/docker/docker/pull/22191)) - Fix restart backoff logic to correctly reset delay if container ran for at least 10secs ([#22125](https://github.com/docker/docker/pull/22125)) - Remove error message when a container restart get cancelled ([#22123](https://github.com/docker/docker/pull/22123)) - Fix an issue where `docker` would not correcly clean up after `docker exec` ([#22121](https://github.com/docker/docker/pull/22121)) - Fix a panic that could occur when servicing concurrent `docker stats` commands ([#22120](https://github.com/docker/docker/pull/22120))` - Revert deprecation of non-existing host directories auto-creation ([#22065](https://github.com/docker/docker/pull/22065)) - Hide misleading rpc error on daemon shutdown ([#22058](https://github.com/docker/docker/pull/22058))- Fix go version to 1.5 (bsc#977394)- Add patch to fix vulnerability in Docker <= 1.11.0. This patch is upstream, but was merged after the 1.11.0 merge window. CVE-2016-3697. bsc#976777. + cve-2016-3697-numeric-uid.patch The upstream PR is here[1] and was vendored into Docker here[2]. [1]: https://github.com/opencontainers/runc/pull/708 [2]: https://github.com/docker/docker/pull/21665- Supplemnent zsh from zsh-completion * zsh-completion will be automatically installed if zsh and docker are installed- Remove gcc5_socker_workaround.patch: This patch is not needed anymore since gcc5 has been updated in all platforms* Removed patches that have been fixed upstream and in gcc-go: - boltdb_bolt_powerpc.patch - fix-apparmor.patch - fix-btrfs-ioctl-structure.patch - fix-docker-init.patch - libnetwork_drivers_bridge_powerpc.patch - ignore-dockerinit-checksum.patch * Require containerd, as it is the only currently supported Docker execdriver. * Update docker.socket to require containerd.socket and use --containerd in docker.service so that the services are self-contained. * Update to Docker 1.11.0. Changelog from upstream: * Builder - Fix a bug where Docker would not used the correct uid/gid when processing the `WORKDIR` command ([#21033](https://github.com/docker/docker/pull/21033)) - Fix a bug where copy operations with userns would not use the proper uid/gid ([#20782](https://github.com/docker/docker/pull/20782), [#21162](https://github.com/docker/docker/pull/21162)) * Client * Usage of the `:` separator for security option has been deprecated. `=` should be used instead ([#21232](https://github.com/docker/docker/pull/21232)) + The client user agent is now passed to the registry on `pull`, `build`, `push`, `login` and `search` operations ([#21306](https://github.com/docker/docker/pull/21306), [#21373](https://github.com/docker/docker/pull/21373)) * Allow setting the Domainname and Hostname separately through the API ([#20200](https://github.com/docker/docker/pull/20200)) * Docker info will now warn users if it can not detect the kernel version or the operating system ([#21128](https://github.com/docker/docker/pull/21128)) - Fix an issue where `docker stats --no-stream` output could be all 0s ([#20803](https://github.com/docker/docker/pull/20803)) - Fix a bug where some newly started container would not appear in a running `docker stats` command ([#20792](https://github.com/docker/docker/pull/20792)) * Post processing is no longer enabled for linux-cgo terminals ([#20587](https://github.com/docker/docker/pull/20587)) - Values to `--hostname` are now refused if they do not comply with [RFC1123](https://tools.ietf.org/html/rfc1123) ([#20566](https://github.com/docker/docker/pull/20566)) + Docker learned how to use a SOCKS proxy ([#20366](https://github.com/docker/docker/pull/20366), [#18373](https://github.com/docker/docker/pull/18373)) + Docker now supports external credential stores ([#20107](https://github.com/docker/docker/pull/20107)) * `docker ps` now supports displaying the list of volumes mounted inside a container ([#20017](https://github.com/docker/docker/pull/20017)) * `docker info` now also report Docker's root directory location ([#19986](https://github.com/docker/docker/pull/19986)) - Docker now prohibits login in with an empty username (spaces are trimmed) ([#19806](https://github.com/docker/docker/pull/19806)) * Docker events attributes are now sorted by key ([#19761](https://github.com/docker/docker/pull/19761)) * `docker ps` no longer show exported port for stopped containers ([#19483](https://github.com/docker/docker/pull/19483)) - Docker now cleans after itself if a save/export command fails ([#17849](https://github.com/docker/docker/pull/17849)) * Docker load learned how to display a progress bar ([#17329](https://github.com/docker/docker/pull/17329), [#120078](https://github.com/docker/docker/pull/20078)) * Distribution - Fix a panic that occurred when pulling an images with 0 layers ([#21222](https://github.com/docker/docker/pull/21222)) - Fix a panic that could occur on error while pushing to a registry with a misconfigured token service ([#21212](https://github.com/docker/docker/pull/21212)) + All first-level delegation roles are now signed when doing a trusted push ([#21046](https://github.com/docker/docker/pull/21046)) + OAuth support for registries was added ([#20970](https://github.com/docker/docker/pull/20970)) * `docker login` now handles token using the implementation found in [docker/distribution](https://github.com/docker/distribution) ([#20832](https://github.com/docker/docker/pull/20832)) * `docker login` will no longer prompt for an email ([#20565](https://github.com/docker/docker/pull/20565)) * Docker will now fallback to registry V1 if no basic auth credentials are available ([#20241](https://github.com/docker/docker/pull/20241)) * Docker will now try to resume layer download where it left off after a network error/timeout ([#19840](https://github.com/docker/docker/pull/19840)) - Fix generated manifest mediaType when pushing cross-repository ([#19509](https://github.com/docker/docker/pull/19509)) - Fix docker requesting additional push credentials when pulling an image if Content Trust is enabled ([#20382](https://github.com/docker/docker/pull/20382)) * Logging - Fix a race in the journald log driver ([#21311](https://github.com/docker/docker/pull/21311)) * Docker syslog driver now uses the RFC-5424 format when emitting logs ([#20121](https://github.com/docker/docker/pull/20121)) * Docker GELF log driver now allows to specify the compression algorithm and level via the `gelf-compression-type` and `gelf-compression-level` options ([#19831](https://github.com/docker/docker/pull/19831)) * Docker daemon learned to output uncolorized logs via the `--raw-logs` options ([#19794](https://github.com/docker/docker/pull/19794)) + Docker, on Windows platform, now includes an ETW (Event Tracing in Windows) logging driver named `etwlogs` ([#19689](https://github.com/docker/docker/pull/19689)) * Journald log driver learned how to handle tags ([#19564](https://github.com/docker/docker/pull/19564)) + The fluentd log driver learned the following options: `fluentd-address`, `fluentd-buffer-limit`, `fluentd-retry-wait`, `fluentd-max-retries` and `fluentd-async-connect` ([#19439](https://github.com/docker/docker/pull/19439)) + Docker learned to send log to Google Cloud via the new `gcplogs` logging driver. ([#18766](https://github.com/docker/docker/pull/18766)) * Misc + When saving linked images together with `docker save` a subsequent `docker load` will correctly restore their parent/child relationship ([#21385](https://github.com/docker/docker/pull/c)) + Support for building the Docker cli for OpenBSD was added ([#21325](https://github.com/docker/docker/pull/21325)) + Labels can now be applied at network, volume and image creation ([#21270](https://github.com/docker/docker/pull/21270)) * The `dockremap` is now created as a system user ([#21266](https://github.com/docker/docker/pull/21266)) - Fix a few response body leaks ([#21258](https://github.com/docker/docker/pull/21258)) - Docker, when run as a service with systemd, will now properly manage its processes cgroups ([#20633](https://github.com/docker/docker/pull/20633)) * Docker info now reports the value of cgroup KernelMemory or emits a warning if it is not supported ([#20863](https://github.com/docker/docker/pull/20863)) * Docker info now also reports the cgroup driver in use ([#20388](https://github.com/docker/docker/pull/20388)) * Docker completion is now available on PowerShell ([#19894](https://github.com/docker/docker/pull/19894)) * `dockerinit` is no more ([#19490](https://github.com/docker/docker/pull/19490),[#19851](https://github.com/docker/docker/pull/19851)) + Support for building Docker on arm64 was added ([#19013](https://github.com/docker/docker/pull/19013)) + Experimental support for building docker.exe in a native Windows Docker installation ([#18348](https://github.com/docker/docker/pull/18348)) * Networking - Fix panic if a node is forcibly removed from the cluster ([#21671](https://github.com/docker/docker/pull/21671)) - Fix "error creating vxlan interface" when starting a container in a Swarm cluster ([#21671](https://github.com/docker/docker/pull/21671)) * `docker network inspect` will now report all endpoints whether they have an active container or not ([#21160](https://github.com/docker/docker/pull/21160)) + Experimental support for the MacVlan and IPVlan network drivers have been added ([#21122](https://github.com/docker/docker/pull/21122)) * Output of `docker network ls` is now sorted by network name ([#20383](https://github.com/docker/docker/pull/20383)) - Fix a bug where Docker would allow a network to be created with the reserved `default` name ([#19431](https://github.com/docker/docker/pull/19431)) * `docker network inspect` returns whether a network is internal or not ([#19357](https://github.com/docker/docker/pull/19357)) + Control IPv6 via explicit option when creating a network (`docker network create --ipv6`). This shows up as a new `EnableIPv6` field in `docker network inspect` ([#17513](https://github.com/docker/docker/pull/17513)) * Support for AAAA Records (aka IPv6 Service Discovery) in embedded DNS Server ([#21396](https://github.com/docker/docker/pull/21396)) - Fix to not forward docker domain IPv6 queries to external servers ([#21396](https://github.com/docker/docker/pull/21396)) * Multiple A/AAAA records from embedded DNS Server for DNS Round robin ([#21019](https://github.com/docker/docker/pull/21019)) - Fix endpoint count inconsistency after an ungraceful dameon restart ([#21261](https://github.com/docker/docker/pull/21261)) - Move the ownership of exposed ports and port-mapping options from Endpoint to Sandbox ([#21019](https://github.com/docker/docker/pull/21019)) - Fixed a bug which prevents docker reload when host is configured with ipv6.disable=1 ([#21019](https://github.com/docker/docker/pull/21019)) - Added inbuilt nil IPAM driver ([#21019](https://github.com/docker/docker/pull/21019)) - Fixed bug in iptables.Exists() logic [#21019](https://github.com/docker/docker/pull/21019) - Fixed a Veth interface leak when using overlay network ([#21019](https://github.com/docker/docker/pull/21019)) - Fixed a bug which prevents docker reload after a network delete during shutdown ([#20214](https://github.com/docker/docker/pull/20214)) - Make sure iptables chains are recreated on firewalld reload ([#20419](https://github.com/docker/docker/pull/20419)) - Allow to pass global datastore during config reload ([#20419](https://github.com/docker/docker/pull/20419)) - For anonymous containers use the alias name for IP to name mapping, ie:DNS PTR record ([#21019](https://github.com/docker/docker/pull/21019)) - Fix a panic when deleting an entry from /etc/hosts file ([#21019](https://github.com/docker/docker/pull/21019)) - Source the forwarded DNS queries from the container net namespace ([#21019](https://github.com/docker/docker/pull/21019)) - Fix to retain the network internal mode config for bridge networks on daemon reload ([#21780] (https://github.com/docker/docker/pull/21780)) - Fix to retain IPAM driver option configs on daemon reload ([#21914] (https://github.com/docker/docker/pull/21914)) * Plugins - Fix a file descriptor leak that would occur every time plugins were enumerated ([#20686](https://github.com/docker/docker/pull/20686)) - Fix an issue where Authz plugin would corrupt the payload body when faced with a large amount of data ([#20602](https://github.com/docker/docker/pull/20602)) * Runtime - Fix a panic that could occur when cleanup after a container started with invalid parameters ([#21716](https://github.com/docker/docker/pull/21716)) - Fix a race with event timers stopping early ([#21692](https://github.com/docker/docker/pull/21692)) - Fix race conditions in the layer store, potentially corrupting the map and crashing the process ([#21677](https://github.com/docker/docker/pull/21677)) - Un-deprecate auto-creation of host directories for mounts. This feature was marked deprecated in ([#21666](https://github.com/docker/docker/pull/21666)) Docker 1.9, but was decided to be too much of an backward-incompatible change, so it was decided to keep the feature. + It is now possible for containers to share the NET and IPC namespaces when `userns` is enabled ([#21383](https://github.com/docker/docker/pull/21383)) + `docker inspect ` will now expose the rootfs layers ([#21370](https://github.com/docker/docker/pull/21370)) + Docker Windows gained a minimal `top` implementation ([#21354](https://github.com/docker/docker/pull/21354)) * Docker learned to report the faulty exe when a container cannot be started due to its condition ([#21345](https://github.com/docker/docker/pull/21345)) * Docker with device mapper will now refuse to run if `udev sync` is not available ([#21097](https://github.com/docker/docker/pull/21097)) - Fix a bug where Docker would not validate the config file upon configuration reload ([#21089](https://github.com/docker/docker/pull/21089)) - Fix a hang that would happen on attach if initial start was to fail ([#21048](https://github.com/docker/docker/pull/21048)) - Fix an issue where registry service options in the daemon configuration file were not properly taken into account ([#21045](https://github.com/docker/docker/pull/21045)) - Fix a race between the exec and resize operations ([#21022](https://github.com/docker/docker/pull/21022)) - Fix an issue where nanoseconds were not correctly taken in account when filtering Docker events ([#21013](https://github.com/docker/docker/pull/21013)) - Fix the handling of Docker command when passed a 64 bytes id ([#21002](https://github.com/docker/docker/pull/21002)) * Docker will now return a `204` (i.e http.StatusNoContent) code when it successfully deleted a network ([#20977](https://github.com/docker/docker/pull/20977)) - Fix a bug where the daemon would wait indefinitely in case the process it was about to killed had already exited on its own ([#20967](https://github.com/docker/docker/pull/20967) * The devmapper driver learned the `dm.min_free_space` option. If the mapped device free space reaches the passed value, new device creation will be prohibited. ([#20786](https://github.com/docker/docker/pull/20786)) + Docker can now prevent processes in container to gain new privileges via the `--security-opt=no-new-privileges` flag ([#20727](https://github.com/docker/docker/pull/20727)) - Starting a container with the `--device` option will now correctly resolves symlinks ([#20684](https://github.com/docker/docker/pull/20684)) + Docker now relies on [`containerd`](https://github.com/docker/containerd) and [`runc`](https://github.com/opencontainers/runc) to spawn containers. ([#20662](https://github.com/docker/docker/pull/20662)) - Fix docker configuration reloading to only alter value present in the given config file ([#20604](https://github.com/docker/docker/pull/20604)) + Docker now allows setting a container hostname via the `--hostname` flag when `--net=host` ([#20177](https://github.com/docker/docker/pull/20177)) + Docker now allows executing privileged container while running with `--userns-remap` if both `--privileged` and the new `--userns=host` flag are specified ([#20111](https://github.com/docker/docker/pull/20111)) - Fix Docker not cleaning up correctly old containers upon restarting after a crash ([#19679](https://github.com/docker/docker/pull/19679)) * Docker will now error out if it doesn't recognize a configuration key within the config file ([#19517](https://github.com/docker/docker/pull/19517)) - Fix container loading, on daemon startup, when they depends on a plugin running within a container ([#19500](https://github.com/docker/docker/pull/19500)) * `docker update` learned how to change a container restart policy ([#19116](https://github.com/docker/docker/pull/19116)) * `docker inspect` now also returns a new `State` field containing the container state in a human readable way (i.e. one of `created`, `restarting`, `running`, `paused`, `exited` or `dead`)([#18966](https://github.com/docker/docker/pull/18966)) + Docker learned to limit the number of active pids (i.e. processes) within the container via the `pids-limit` flags. NOTE: This requires `CGROUP_PIDS=y` to be in the kernel configuration. ([#18697](https://github.com/docker/docker/pull/18697)) - `docker load` now has a `--quiet` option to suppress the load output ([#20078](https://github.com/docker/docker/pull/20078)) - Fix a bug in neighbor discovery for IPv6 peers ([#20842](https://github.com/docker/docker/pull/20842)) - Fix a panic during cleanup if a container was started with invalid options ([#21802](https://github.com/docker/docker/pull/21802)) - Fix a situation where a container cannot be stopped if the terminal is closed ([#21840](https://github.com/docker/docker/pull/21840)) * Security * Object with the `pcp_pmcd_t` selinux type were given management access to `/var/lib/docker(/.*)?` ([#21370](https://github.com/docker/docker/pull/21370)) * `restart_syscall`, `copy_file_range`, `mlock2` joined the list of allowed calls in the default seccomp profile ([#21117](https://github.com/docker/docker/pull/21117), [#21262](https://github.com/docker/docker/pull/21262)) * `send`, `recv` and `x32` were added to the list of allowed syscalls and arch in the default seccomp profile ([#19432](https://github.com/docker/docker/pull/19432)) * Docker Content Trust now requests the server to perform snapshot signing ([#21046](https://github.com/docker/docker/pull/21046)) * Support for using YubiKeys for Content Trust signing has been moved out of experimental ([#21591](https://github.com/docker/docker/pull/21591)) * Volumes * Output of `docker volume ls` is now sorted by volume name ([#20389](https://github.com/docker/docker/pull/20389)) * Local volumes can now accepts options similar to the unix `mount` tool ([#20262](https://github.com/docker/docker/pull/20262)) - Fix an issue where one letter directory name could not be used as source for volumes ([#21106](https://github.com/docker/docker/pull/21106)) + `docker run -v` now accepts a new flag `nocopy`. This tell the runtime not to copy the container path content into the volume (which is the default behavior) ([#21223](https://github.com/docker/docker/pull/21223))- docker.spec: apply gcc5 socket patch also for sle12 and leap because gcc5 has been updated there as well. - docker.spec: add a "is_opensuse" check for the mount-secrets patch. This way we can use this same package for opensuse.- use go-lang for aarch64: - drop fix_platform_type_arm.patch (works around a gcc-go bug, so unnecessary)- Add patch from upstream (https://github.com/docker/docker/pull/21723) to fix compilation on Factory and Tumbleweed (which have btrfsprogs >= 4.5). + fix-btrfs-ioctl-structure.patch bnc#974208- Changed systemd unit file and default sysconfig file to include network options, this is needed to get SDN like flannel to work- docker.spec: update warning to mention that /etc/sysconfig/docker is sourced by the migration script.- docker.spec: only Reccomends: the docker-image-migrator package as it is no longer required for our ugly systemctl hacks. - docker.spec: fix up documentation to refer to the script you need to run in the migrator package. - docker.spec: print a warning if you force the DOCKER_FORCE_INSTALL option.- spec: switch to new done file name from docker-image-migrator- update to docker 1.10.3 (bnc#970637) Runtime Fix Docker client exiting with an "Unrecognized input header" error #20706 Fix Docker exiting if Exec is started with both AttachStdin and Detach #20647 Distribution Fix a crash when pushing multiple images sharing the same layers to the same repository in parallel #20831 Fix a panic when pushing images to a registry which uses a misconfigured token service #21030 Plugin system Fix issue preventing volume plugins to start when SELinux is enabled #20834 Prevent Docker from exiting if a volume plugin returns a null response for Get requests #20682 Fix plugin system leaking file descriptors if a plugin has an error #20680 Security Fix linux32 emulation to fail during docker build #20672 It was due to the personality syscall being blocked by the default seccomp profile. Fix Oracle XE 10g failing to start in a container #20981 It was due to the ipc syscall being blocked by the default seccomp profile. Fix user namespaces not working on Linux From Scratch #20685 Fix issue preventing daemon to start if userns is enabled and the subuid or subgid files contain comments #20725 More at https://github.com/docker/docker/releases/tag/v1.10.3- spec: improve file-based migration checks to make sure that it doesn't cause errors if running on a /var/lib/docker without /var/lib/docker/graph.- spec: implement file-based migration checks. The migrator will be updated to match the warning message's instructions. This looks like it works with my testing.- more patches to build on ppc64 architecture update netlink_gcc_go.patch new netlink_netns_powerpc.patch new boltdb_bolt_powerpc.patch new libnetwork_drivers_bridge_powerpc.patch to replace deleted fix-ppc64le.patch- fix bsc#968972 - let docker manage the cgroups of the processes that it launches without systemd- Require docker-image-migrator (bnc#968933)Update to version 1.10.2 (bnc#968933) - Runtime Prevent systemd from deleting containers' cgroups when its configuration is reloaded #20518 Fix SELinux issues by disregarding --read-only when mounting /dev/mqueue #20333 Fix chown permissions used during docker cp when userns is used #20446 Fix configuration loading issue with all booleans defaulting to true #20471 Fix occasional panic with docker logs -f #20522 - Distribution Keep layer reference if deletion failed to avoid a badly inconsistent state #20513 Handle gracefully a corner case when canceling migration #20372 Fix docker import on compressed data #20367 Fix tar-split files corruption during migration that later cause docker push and docker save to fail #20458 - Networking Fix daemon crash if embedded DNS is sent garbage #20510 - Volumes Fix issue with multiple volume references with same name #20381 - Security Fix potential cache corruption and delegation conflict issues #20523 link to changelog: https://github.com/docker/docker/blob/v1.10.2/CHANGELOG.md- fix-apparmor.patch: switch to a backported version of docker/docker#20305, which also fixes several potential issues if the major version of apparmor changes.- Remove 1.10.0 tarball.- Update to docker 1.10.1 It includes some fixes to 1.10.0, see detailed changelog in https://github.com/docker/docker/blob/v1.10.1/CHANGELOG.md- Update docker to 1.10.0 (bnc#965918) Add usernamespace support Add support for custom seccomp profiles Improvements in network and volume management detailed changelog in https://github.com/docker/docker/blob/590d5108bbdaabb05af590f76c9757daceb6d02e/CHANGELOG.md - removed patches, because code has been merged in 1.10.0 release: libcontainer-apparmor-fixes.patch: see: https://github.com/docker/docker/blob/release/v1.10/contrib/apparmor/template.go fix_bnc_958255.patch: see https://github.com/docker/docker/commit/2b4f64e59018c21aacbf311d5c774dd5521b5352 use_fs_cgroups_by_default.patch fix_cgroup.parent_path_sanitisation.patch add_bolt_ppc64.patch add_bolt_arm64.patch add_bolt_s390x.patch - remove gcc-go-build-static-libgo.patch: This has been replace by gcc-go-patches.patch - removed patches, because arm and ppc are not build using the dynbinary target, but the dyngccgo one: docker_remove_journald_to_fix_dynbinary_build_on_arm.patch docker_remove_journald_to_fix_dynbinary_build_on_powerpc.patch docker_remove_journald_to_fix_dynbinary_build_on_arm64.patch - added patches: fix_platform_type_arm.patch: fix build for arm64 and aarch64: set utsname as uint8 for arm64 and aarch64 gcc5_socket_workaround.patch: gcc5-go in Tumbleweed includes this commit https://github.com/golang/gofrontend/commit/a850225433a66a58613c22185c3b09626f5545eb Which "fixes" the data type for RawSockaddr.Data However, docker now expects the "wrong" data type, since docker had a workaround for that issue. Thus, we need to workaround the workaround in tumbleweed netlink_gcc_go.patch: add constants for syscalls TUNSETIFF and TUNSETPERSIST to fix a gcc issue. This is a workaround for bnc#964468: gcc-go can no longer compile Docker. fix-apparmor.patch: fix https://github.com/docker/docker/issues/20269 . It affects SLE12 which has apparmor version 2.8 and not openSUSE which has version 2.9. fix-ppc64le.patch: Build netlink driver using int8 and not uint8 for the data structure - reviewed patches: ignore-dockerinit-checksum.patch: review context in patch fix-docker-init.patch: review patch because build method has been changed in spec file for gcc-go gcc-go-patches.patch: review context in patch - Build requires go >= 1.5: For version 1.9, we could use Go 1.4.3 see GO_VERSION https://github.com/docker/docker/blob/release/v1.9/Dockerfile However, for version 1.10, we need go 1.5.3 see GO_VERSION https://github.com/docker/docker/blob/release/v1.10/Dockerfile - fix bnc#965600 - SLES12 SP1 - Static shared memory limit in container- docker-mount-secrets.patch: fix up this patch to work on Docker 1.10- docker-mount-secrets.patch: properly register /run/secrets as a mountpoint, so that it is unmounted properly when the container is removed and thus container removal works. (bnc#963142) - docker-mount-secrets.patch: in addition, add some extra debugging information to the secrets patch.- fix_json_econnreset_bug.patch: fix JSON bug that causes containers to not start in weird circumstances. https://github.com/docker/docker/issues/14203- fix_bnc_958255.patch: fix Docker creates strange apparmor profile (bnc#958255) - use_fs_cgroups_by_default.patch: Use fs cgroups by default: https://github.com/docker/docker/commit/419fd7449fe1a984f582731fcd4d9455000846b0 - fix_cgroup.parent_path_sanitisation.patch: fix cgroup.Parent path sanitisation: https://github.com/opencontainers/runc/commit/bf899fef451956be4abd63de6d6141d9f9096a02 - Add rules for auditd. This is required to fix bnc#959405 - Remove 7 patches, add 6 and modify 1, after 1.9.1 upgrade * Removed: - docker_missing_ppc64le_netlink_linux_files.patch: the code that this bug refers to has benn removed upstream - docker_rename_jump_amd64_as_jump_linux.patch: the code that this bug refers to has been removed upstream - Remove fix_15279.patch: code has been merged upstream - Remove add_missing_syscall_for_s390x.patch: code has been merged upstream - Remove fix_incompatible_assignment_error_bnc_950931.patch: code has been merged upstream - Remove fix_libsecomp_error_bnc_950931.patch: the code that this bug refers to has been removed upstream - Remove gcc5_socket_workaround.patch: Code has been fixed. Building with this patch is giving the error we were trying to fix, implying that the code has been fixed somewhere else. * Added: - add_bolt_ppc64.patch - add_bolt_arm64.patch - docker_remove_journald_to_fix_dynbinary_build_on_arm.patch - docker_remove_journald_to_fix_dynbinary_build_on_powerpc.patch - docker_remove_journald_to_fix_dynbinary_build_on_arm64.patch - gcc-go-build-static-libgo.patch: enable static linking of libgo in ggc-go In order to do this, we had to work-around an issue from gcc-go: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69357 * Modify: - Upgrade to 1.9.1(bnc#956434) * Runtime: - Do not prevent daemon from booting if images could not be restored (#17695) - Force IPC mount to unmount on daemon shutdown/init (#17539) - Turn IPC unmount errors into warnings (#17554) - Fix `docker stats` performance regression (#17638) - Clarify cryptic error message upon `docker logs` if `--log-driver=none` (#17767) - Fix seldom panics (#17639, #17634, #17703) - Fix opq whiteouts problems for files with dot prefix (#17819) - devicemapper: try defaulting to xfs instead of ext4 for performance reasons (#17903, #17918) - devicemapper: fix displayed fs in docker info (#17974) - selinux: only relabel if user requested so with the `z` option (#17450, #17834) - Do not make network calls when normalizing names (#18014) * Client: - Fix `docker login` on windows (#17738) - Fix bug with `docker inspect` output when not connected to daemon (#17715) - Fix `docker inspect -f {{.HostConfig.Dns}} somecontainer` (#17680) * Builder: - Fix regression with symlink behavior in ADD/COPY (#17710) * Networking: - Allow passing a network ID as an argument for `--net` (#17558) - Fix connect to host and prevent disconnect from host for `host` network (#17476) - Fix `--fixed-cidr` issue when gateway ip falls in ip-range and ip-range is not the first block in the network (#17853) - Restore deterministic `IPv6` generation from `MAC` address on default `bridge` network (#17890) - Allow port-mapping only for endpoints created on docker run (#17858) - Fixed an endpoint delete issue with a possible stale sbox (#18102) * Distribution: - Correct parent chain in v2 push when v1Compatibility files on the disk are inconsistent (#18047) - Update to version 1.9.0 (bnc#954812): * Runtime: - `docker stats` now returns block IO metrics (#15005) - `docker stats` now details network stats per interface (#15786) - Add `ancestor=` filter to `docker ps --filter` flag to filter containers based on their ancestor images (#14570) - Add `label=` filter to `docker ps --filter` to filter containers based on label (#16530) - Add `--kernel-memory` flag to `docker run` (#14006) - Add `--message` flag to `docker import` allowing to specify an optional message (#15711) - Add `--privileged` flag to `docker exec` (#14113) - Add `--stop-signal` flag to `docker run` allowing to replace the container process stopping signal (#15307) - Add a new `unless-stopped` restart policy (#15348) - Inspecting an image now returns tags (#13185) - Add container size information to `docker inspect` (#15796) - Add `RepoTags` and `RepoDigests` field to `/images/{name:.*}/json` (#17275) - Remove the deprecated `/container/ps` endpoint from the API (#15972) - Send and document correct HTTP codes for `/exec//start` (#16250) - Share shm and mqueue between containers sharing IPC namespace (#15862) - Event stream now shows OOM status when `--oom-kill-disable` is set (#16235) - Ensure special network files (/etc/hosts etc.) are read-only if bind-mounted with `ro` option (#14965) - Improve `rmi` performance (#16890) - Do not update /etc/hosts for the default bridge network, except for links (#17325) - Fix conflict with duplicate container names (#17389) - Fix an issue with incorrect template execution in `docker inspect` (#17284) - DEPRECATE `-c` short flag variant for `--cpu-shares` in docker run (#16271) * Client: - Allow `docker import` to import from local files (#11907) * Builder: - Add a `STOPSIGNAL` Dockerfile instruction allowing to set a different stop-signal for the container process (#15307) - Add an `ARG` Dockerfile instruction and a `--build-arg` flag to `docker build` that allows to add build-time environment variables (#15182) - Improve cache miss performance (#16890) * Storage: - devicemapper: Implement deferred deletion capability (#16381) * Networking: - `docker network` exits experimental and is part of standard release (#16645) - New network top-level concept, with associated subcommands and API (#16645) WARNING: the API is different from the experimental API - Support for multiple isolated/micro-segmented networks (#16645) - Built-in multihost networking using VXLAN based overlay driver (#14071) - Support for third-party network plugins (#13424) - Ability to dynamically connect containers to multiple networks (#16645) - Support for user-defined IP address management via pluggable IPAM drivers (#16910) - Add daemon flags `--cluster-store` and `--cluster-advertise` for built-in nodes discovery (#16229) - Add `--cluster-store-opt` for setting up TLS settings (#16644) - Add `--dns-opt` to the daemon (#16031) - DEPRECATE following container `NetworkSettings` fields in API v1.21: `EndpointID`, `Gateway`, `GlobalIPv6Address`, `GlobalIPv6PrefixLen`, `IPAddress`, `IPPrefixLen`, `IPv6Gateway` and `MacAddress`. Those are now specific to the `bridge` network. Use `NetworkSettings.Networks` to inspect the networking settings of a container per network. * Volumes: - New top-level `volume` subcommand and API (#14242) - Move API volume driver settings to host-specific config (#15798) - Print an error message if volume name is not unique (#16009) - Ensure volumes created from Dockerfiles always use the local volume driver (#15507) - DEPRECATE auto-creating missing host paths for bind mounts (#16349) * Logging: - Add `awslogs` logging driver for Amazon CloudWatch (#15495) - Add generic `tag` log option to allow customizing container/image information passed to driver (e.g. show container names) (#15384) - Implement the `docker logs` endpoint for the journald driver (#13707) - DEPRECATE driver-specific log tags (e.g. `syslog-tag`, etc.) (#15384) * Distribution: - `docker search` now works with partial names (#16509) - Push optimization: avoid buffering to file (#15493) - The daemon will display progress for images that were already being pulled by another client (#15489) - Only permissions required for the current action being performed are requested (#) - Renaming trust keys (and respective environment variables) from `offline` to `root` and `tagging` to `repository` (#16894) - DEPRECATE trust key environment variables `DOCKER_CONTENT_TRUST_OFFLINE_PASSPHRASE` and `DOCKER_CONTENT_TRUST_TAGGING_PASSPHRASE` (#16894) * Security: - Add SELinux profiles to the rpm package (#15832) - Fix various issues with AppArmor profiles provided in the deb package (#14609) - Add AppArmor policy that prevents writing to /proc (#15571) - Change systemd unit file to no longer use the deprecated "-d" option (bnc#954737)- Changed docker-mount-secrets.patch: allow removal of containers even when the entry point failed. bnc#954797- Fixed the format of the fix_libsecomp_error_bnc_950931 patch.- Merged the fix_libsecomp_error_bnc_950931.patch and the fix_x86_build_removing_empty_file_jump_amd_64.patch patches.- Fix build for x86_64. Patch fix_libsecomp_error_bnc_950931.patch had created and empty file jump_amd64.go instead of removing it. This broke the build for x86_64. This commit fixes it by removing that empty file. fix_x86_build_removing_empty_file_jump_amd_64.patch: patch that removes empty file jump_amd64.go- Added patch that fixes a known gcc-go for ppc64xe in the syscall.RawSockAddr type. gcc5_socket_workaround.patch- Add patches for fixing ppc64le build (bnc#950931) fix_libsecomp_error_bnc_950931.patch fix_incompatible_assignment_error_bnc_950931.patch docker_missing_ppc64le_netlink_linux_files.patch - Remove docker_rename_jump_amd64_as_jump_linux.patch because it clashes with the previous patches.- Exclude libgo as a requirement. The auto requires script was adding libgo as a requirement when building with gcc-go which was wrong.- Add patch for missing systemcall for s390x. See https://github.com/docker/docker/commit/eecf6cd48cf7c48f00aa8261cf431c87084161ae add_missing_syscall_for_s390x.patch: contains the patch - Exclude s390x for sle12 because it hangs when running go. It works for sle12sp1 thus we don't want to exclude sle12sp1 but only sle12.- Update docker to 1.8.3 version: * Fix layer IDs lead to local graph poisoning (CVE-2014-8178) (bnc#949660) * Fix manifest validation and parsing logic errors allow pull-by-digest validation bypass (CVE-2014-8179) * Add `--disable-legacy-registry` to prevent a daemon from using a v1 registry- Update docker to 1.8.2 version see detailed changelog in https://github.com/docker/docker/releases/tag/v1.8.2 fix bsc#946653 update do docker 1.8.2 - devicemapper: fix zero-sized field access Fix issue #15279: does not build with Go 1.5 tip Due to golang/go@7904946 the devices field is dropped. This solution works on go1.4 and go1.5 See more in https://github.com/docker/docker/pull/15404 This fix was not included in v1.8.2. See previous link on why. fix_15279.patch: contains the patch for issue#15279- new patch as per upstream issue https://github.com/docker/docker/issues/14056#issuecomment-113680944 docker_rename_jump_amd64_as_jump_linux.patch- ignore-dockerinit-checksum.patch need -p1 in spec- Update to docker 1.8.1(bsc#942369 and bsc#942370): - Fix a bug where pushing multiple tags would result in invalid images - Update to docker 1.8.0: see detailed changelog in https://github.com/docker/docker/releases/tag/v1.8.0 - remove docker-netns-aarch64.patch: This patch was adding vendor/src/github.com/vishvananda/netns/netns_linux_arm64.go which is now included upstream, so we don't need this patch anymore- Remove 0002-Stripped-dockerinit-binary.patch because we do not use it anymore (we got rid of that when updating to 1.7.1)- Exclude archs where docker does not build. Otherwise it gets into and infinite loop when building. We'll fix that later if we want to release for those archs.- Update to 1.7.1 (2015-07-14) (bnc#938156) * Runtime - Fix default user spawning exec process with docker exec - Make --bridge=none not to configure the network bridge - Publish networking stats properly - Fix implicit devicemapper selection with static binaries - Fix socket connections that hung intermittently - Fix bridge interface creation on CentOS/RHEL 6.6 - Fix local dns lookups added to resolv.conf - Fix copy command mounting volumes - Fix read/write privileges in volumes mounted with --volumes-from * Remote API - Fix unmarshalling of Command and Entrypoint - Set limit for minimum client version supported - Validate port specification - Return proper errors when attach/reattach fail * Distribution - Fix pulling private images - Fix fallback between registry V2 and V1- Exclude init scripts other than systemd from the test-package- Exclude intel 32 bits arch. Docker does not built on that. Let's make it explicit.- rediff ignore-dockerinit-checksum.patch, gcc-go-build-static-libgo.patch to make them apply again. - introduce go_arches for architectures that use the go compiler instead of gcc-go - add docker-netns-aarch64.patch: Add support for AArch64 - enable build for aarch64- Build man pages only on platforms where gc compiler is available.- Updated to 1.7.0 (2015-06-16) - bnc#935570 * Runtime - Experimental feature: support for out-of-process volume plugins - The userland proxy can be disabled in favor of hairpin NAT using the daemon’s `--userland-proxy=false` flag - The `exec` command supports the `-u|--user` flag to specify the new process owner - Default gateway for containers can be specified daemon-wide using the `--default-gateway` and `--default-gateway-v6` flags - The CPU CFS (Completely Fair Scheduler) quota can be set in `docker run` using `--cpu-quota` - Container block IO can be controlled in `docker run` using`--blkio-weight` - ZFS support - The `docker logs` command supports a `--since` argument - UTS namespace can be shared with the host with `docker run --uts=host` * Quality - Networking stack was entirely rewritten as part of the libnetwork effort - Engine internals refactoring - Volumes code was entirely rewritten to support the plugins effort - Sending SIGUSR1 to a daemon will dump all goroutines stacks without exiting * Build - Support ${variable:-value} and ${variable:+value} syntax for environment variables - Support resource management flags `--cgroup-parent`, `--cpu-period`, `--cpu-quota`, `--cpuset-cpus`, `--cpuset-mems` - git context changes with branches and directories - The .dockerignore file support exclusion rules * Distribution - Client support for v2 mirroring support for the official registry * Bugfixes - Firewalld is now supported and will automatically be used when available - mounting --device recursively - Patch 0002-Stripped-dockerinit-binary.patch renamed to fix-docker-init.patch and fixed to build with latest version of docker- Add test subpackage and fix line numbers in patches- Fixed ppc64le name inside of spec file- Build docker on PPC and S390x using gcc-go provided by gcc5 * added sysconfig.docker.ppc64le: make docker daemon start on ppc64le despite some iptables issues. To be removed soon * ignore-dockerinit-checksum.patch: applied only when building with gcc-go. Required to workaround a limitation of gcc-go * gcc-go-build-static-libgo.patch: used only when building with gcc-go, link libgo statically into docker itself.- Remove set-SCC_URL-env-variable.patch, the SCC_URL is now read from SUSEConnect by the container service- Automatically set SCC_URL environment variable inside of the containers by parsing the /etc/SUSEConnect.example file * Add set-SCC_URL-env-variable.patch- Place SCC machine credentials inside of /run/secrets/credentials.d * Edit docker-mount-scc-credentials.patch¬- pass the SCC machine credentials to the container * Add docker-mount-scc-credentials.patch- build and install man pages- Update to version 1.6.2 (2015-05-13) [bnc#931301] * Revert change prohibiting mounting into /sysUpdated to version 1.6.1 (2015-05-07) [bnc#930235] * Security - Fix read/write /proc paths (CVE-2015-3630) - Prohibit VOLUME /proc and VOLUME / (CVE-2015-3631) - Fix opening of file-descriptor 1 (CVE-2015-3627) - Fix symlink traversal on container respawn allowing local privilege escalation (CVE-2015-3629) - Prohibit mount of /sys * Runtime - Update Apparmor policy to not allow mounts - Updated libcontainer-apparmor-fixes.patch: adapt patch to reflect changes introduced by docker 1.6.1- Get rid of SocketUser and SocketGroup workarounds for docker.socket- Updated to version 1.6.0 (2015-04-07) [bnc#908033] * Builder: + Building images from an image ID + build containers with resource constraints, ie `docker build --cpu-shares=100 --memory=1024m...` + `commit --change` to apply specified Dockerfile instructions while committing the image + `import --change` to apply specified Dockerfile instructions while importing the image + basic build cancellation * Client: + Windows Support * Runtime: + Container and image Labels + `--cgroup-parent` for specifying a parent cgroup to place container cgroup within + Logging drivers, `json-file`, `syslog`, or `none` + Pulling images by ID + `--ulimit` to set the ulimit on a container + `--default-ulimit` option on the daemon which applies to all created containers (and overwritten by `--ulimit` on run) - Updated '0002-Stripped-dockerinit-binary.patch' to reflect changes inside of the latest version of Docker. - bnc#908033: support of Docker Registry API v2.- enable build for armv7l- Updated docker.spec to fixed building with the latest version of our Go pacakge. - Updated 0002-Stripped-dockerinit-binary.patch to fix check made by the docker daemon against the dockerinit binary.- Updated systemd service and socket units to fix socket activation and to align with best practices recommended by upstram. Moreover socket activation fixes bnc#920645.- Updated to 1.5.0 (2015-02-10): * Builder: - Dockerfile to use for a given `docker build` can be specified with the `-f` flag - Dockerfile and .dockerignore files can be themselves excluded as part of the .dockerignore file, thus preventing modifications to these files invalidating ADD or COPY instructions cache - ADD and COPY instructions accept relative paths - Dockerfile `FROM scratch` instruction is now interpreted as a no-base specifier - Improve performance when exposing a large number of ports * Hack: - Allow client-side only integration tests for Windows - Include docker-py integration tests against Docker daemon as part of our test suites * Packaging: - Support for the new version of the registry HTTP API - Speed up `docker push` for images with a majority of already existing layers - Fixed contacting a private registry through a proxy * Remote API: - A new endpoint will stream live container resource metrics and can be accessed with the `docker stats` command - Containers can be renamed using the new `rename` endpoint and the associated `docker rename` command - Container `inspect` endpoint show the ID of `exec` commands running in this container - Container `inspect` endpoint show the number of times Docker auto-restarted the container - New types of event can be streamed by the `events` endpoint: ‘OOM’ (container died with out of memory), ‘exec_create’, and ‘exec_start' - Fixed returned string fields which hold numeric characters incorrectly omitting surrounding double quotes * Runtime: - Docker daemon has full IPv6 support - The `docker run` command can take the `--pid=host` flag to use the host PID namespace, which makes it possible for example to debug host processes using containerized debugging tools - The `docker run` command can take the `--read-only` flag to make the container’s root filesystem mounted as readonly, which can be used in combination with volumes to force a container’s processes to only write to locations that will be persisted - Container total memory usage can be limited for `docker run` using the `—memory-swap` flag - Major stability improvements for devicemapper storage driver - Better integration with host system: containers will reflect changes to the host's `/etc/resolv.conf` file when restarted - Better integration with host system: per-container iptable rules are moved to the DOCKER chain - Fixed container exiting on out of memory to return an invalid exit code * Other: - The HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables are properly taken into account by the client when connecting to the Docker daemon- Updated to 1.4.1 (2014-12-15): * Runtime: - Fix issue with volumes-from and bind mounts not being honored after create (fixes bnc#913213)- Added e2fsprogs as runtime dependency, this is required when the devicemapper driver is used. (bnc#913211). - Fixed owner & group for docker.socket (thanks to Andrei Dziahel and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752555#5)- Updated to 1.4.0 (2014-12-11): * Notable Features since 1.3.0: - Set key=value labels to the daemon (displayed in `docker info`), applied with new `-label` daemon flag - Add support for `ENV` in Dockerfile of the form: `ENV name=value name2=value2...` - New Overlayfs Storage Driver - `docker info` now returns an `ID` and `Name` field - Filter events by event name, container, or image - `docker cp` now supports copying from container volumes - Fixed `docker tag`, so it honors `--force` when overriding a tag for existing image. - Changes introduced by 1.3.3 (2014-12-11): * Security: - Fix path traversal vulnerability in processing of absolute symbolic links (CVE-2014-9356) - (bnc#909709) - Fix decompression of xz image archives, preventing privilege escalation (CVE-2014-9357) - (bnc#909710) - Validate image IDs (CVE-2014-9358) - (bnc#909712) * Runtime: - Fix an issue when image archives are being read slowly * Client: - Fix a regression related to stdin redirection - Fix a regression with `docker cp` when destination is the current directory- Updated to 1.3.2 (2014-11-20) - fixes bnc#907012 (CVE-2014-6407) and bnc#907014 (CVE-2014-6408) * Security: - Fix tar breakout vulnerability - Extractions are now sandboxed chroot - Security options are no longer committed to images * Runtime: - Fix deadlock in `docker ps -f exited=1` - Fix a bug when `--volumes-from` references a container that failed to start * Registry: - `--insecure-registry` now accepts CIDR notation such as 10.1.0.0/16 - Private registries whose IPs fall in the 127.0.0.0/8 range do no need the `--insecure-registry` flag - Skip the experimental registry v2 API when mirroring is enabled - Fixed minor packaging issues.- Updated to version 1.3.1 2014-10-28) * Security: - Prevent fallback to SSL protocols < TLS 1.0 for client, daemon and registry [CVE-2014-5277] - Secure HTTPS connection to registries with certificate verification and without HTTP fallback unless `--insecure-registry` is specified * Runtime: - Fix issue where volumes would not be shared * Client: - Fix issue with `--iptables=false` not automatically setting `--ip-masq=false` - Fix docker run output to non-TTY stdout * Builder: - Fix escaping `$` for environment variables - Fix issue with lowercase `onbuild` Dockerfile instruction - Restrict envrionment variable expansion to `ENV`, `ADD`, `COPY`, `WORKDIR`, `EXPOSE`, `VOLUME` and `USER`- Upgraded to version 1.3.0 (2014-10-14) * docker `exec` allows you to run additional processes inside existing containers * docker `create` gives you the ability to create a container via the cli without executing a process * `--security-opts` options to allow user to customize container labels and apparmor profiles * docker `ps` filters * wildcard support to copy/add * move production urls to get.docker.com from get.docker.io * allocate ip address on the bridge inside a valid cidr * use drone.io for pr and ci testing * ability to setup an official registry mirror * Ability to save multiple images with docker `save`/bin/sh/bin/sh/bin/sh/bin/shdockerdocker-libnetworkmourvedre 1773650349  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~24.0.9_ce-150000.1.39.124.0.9_ce0.7.0.2.24.0.9_ce24.0.9_ce-150000.1.39.124.0.9_ce-150000.1.39.124.0.9_ce0.7.0.2 rules.ddocker.rulesdockerdaemon.jsonsuse-secrets-enabledockerdocker-proxydockerddockercli-pluginsdocker.servicedocker.socketdocker.conf80-docker.rulesrcdockerdocker-stableREADME.mdREADME_SUSE.mdsysconfig.dockerdocker-stableLICENSEdocker-attach.1.gzdocker-build.1.gzdocker-builder-build.1.gzdocker-builder-prune.1.gzdocker-builder.1.gzdocker-checkpoint-create.1.gzdocker-checkpoint-ls.1.gzdocker-checkpoint-rm.1.gzdocker-checkpoint.1.gzdocker-commit.1.gzdocker-config-create.1.gzdocker-config-inspect.1.gzdocker-config-ls.1.gzdocker-config-rm.1.gzdocker-config.1.gzdocker-container-attach.1.gzdocker-container-commit.1.gzdocker-container-cp.1.gzdocker-container-create.1.gzdocker-container-diff.1.gzdocker-container-exec.1.gzdocker-container-export.1.gzdocker-container-inspect.1.gzdocker-container-kill.1.gzdocker-container-logs.1.gzdocker-container-ls.1.gzdocker-container-pause.1.gzdocker-container-port.1.gzdocker-container-prune.1.gzdocker-container-rename.1.gzdocker-container-restart.1.gzdocker-container-rm.1.gzdocker-container-run.1.gzdocker-container-start.1.gzdocker-container-stats.1.gzdocker-container-stop.1.gzdocker-container-top.1.gzdocker-container-unpause.1.gzdocker-container-update.1.gzdocker-container-wait.1.gzdocker-container.1.gzdocker-context-create.1.gzdocker-context-export.1.gzdocker-context-import.1.gzdocker-context-inspect.1.gzdocker-context-ls.1.gzdocker-context-rm.1.gzdocker-context-show.1.gzdocker-context-update.1.gzdocker-context-use.1.gzdocker-context.1.gzdocker-cp.1.gzdocker-create.1.gzdocker-diff.1.gzdocker-events.1.gzdocker-exec.1.gzdocker-export.1.gzdocker-history.1.gzdocker-image-build.1.gzdocker-image-history.1.gzdocker-image-import.1.gzdocker-image-inspect.1.gzdocker-image-load.1.gzdocker-image-ls.1.gzdocker-image-prune.1.gzdocker-image-pull.1.gzdocker-image-push.1.gzdocker-image-rm.1.gzdocker-image-save.1.gzdocker-image-tag.1.gzdocker-image.1.gzdocker-images.1.gzdocker-import.1.gzdocker-info.1.gzdocker-inspect.1.gzdocker-kill.1.gzdocker-load.1.gzdocker-login.1.gzdocker-logout.1.gzdocker-logs.1.gzdocker-manifest-annotate.1.gzdocker-manifest-create.1.gzdocker-manifest-inspect.1.gzdocker-manifest-push.1.gzdocker-manifest-rm.1.gzdocker-manifest.1.gzdocker-network-connect.1.gzdocker-network-create.1.gzdocker-network-disconnect.1.gzdocker-network-inspect.1.gzdocker-network-ls.1.gzdocker-network-prune.1.gzdocker-network-rm.1.gzdocker-network.1.gzdocker-node-demote.1.gzdocker-node-inspect.1.gzdocker-node-ls.1.gzdocker-node-promote.1.gzdocker-node-ps.1.gzdocker-node-rm.1.gzdocker-node-update.1.gzdocker-node.1.gzdocker-pause.1.gzdocker-plugin-create.1.gzdocker-plugin-disable.1.gzdocker-plugin-enable.1.gzdocker-plugin-inspect.1.gzdocker-plugin-install.1.gzdocker-plugin-ls.1.gzdocker-plugin-push.1.gzdocker-plugin-rm.1.gzdocker-plugin-set.1.gzdocker-plugin-upgrade.1.gzdocker-plugin.1.gzdocker-port.1.gzdocker-ps.1.gzdocker-pull.1.gzdocker-push.1.gzdocker-rename.1.gzdocker-restart.1.gzdocker-rm.1.gzdocker-rmi.1.gzdocker-run.1.gzdocker-save.1.gzdocker-search.1.gzdocker-secret-create.1.gzdocker-secret-inspect.1.gzdocker-secret-ls.1.gzdocker-secret-rm.1.gzdocker-secret.1.gzdocker-service-create.1.gzdocker-service-inspect.1.gzdocker-service-logs.1.gzdocker-service-ls.1.gzdocker-service-ps.1.gzdocker-service-rm.1.gzdocker-service-rollback.1.gzdocker-service-scale.1.gzdocker-service-update.1.gzdocker-service.1.gzdocker-stack-config.1.gzdocker-stack-deploy.1.gzdocker-stack-ls.1.gzdocker-stack-ps.1.gzdocker-stack-rm.1.gzdocker-stack-services.1.gzdocker-stack.1.gzdocker-start.1.gzdocker-stats.1.gzdocker-stop.1.gzdocker-swarm-ca.1.gzdocker-swarm-init.1.gzdocker-swarm-join-token.1.gzdocker-swarm-join.1.gzdocker-swarm-leave.1.gzdocker-swarm-unlock-key.1.gzdocker-swarm-unlock.1.gzdocker-swarm-update.1.gzdocker-swarm.1.gzdocker-system-df.1.gzdocker-system-events.1.gzdocker-system-info.1.gzdocker-system-prune.1.gzdocker-system.1.gzdocker-tag.1.gzdocker-top.1.gzdocker-trust-inspect.1.gzdocker-trust-key-generate.1.gzdocker-trust-key-load.1.gzdocker-trust-key.1.gzdocker-trust-revoke.1.gzdocker-trust-sign.1.gzdocker-trust-signer-add.1.gzdocker-trust-signer-remove.1.gzdocker-trust-signer.1.gzdocker-trust.1.gzdocker-unpause.1.gzdocker-update.1.gzdocker-version.1.gzdocker-volume-create.1.gzdocker-volume-inspect.1.gzdocker-volume-ls.1.gzdocker-volume-prune.1.gzdocker-volume-rm.1.gzdocker-volume-update.1.gzdocker-volume.1.gzdocker-wait.1.gzdocker.1.gzDockerfile.5.gzdockerd.8.gzdocker/etc/audit//etc/audit/rules.d//etc//etc/docker//usr/bin//usr/lib//usr/lib/docker//usr/lib/systemd/system//usr/lib/sysusers.d//usr/lib/udev/rules.d//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/docker-stable//usr/share/fillup-templates//usr/share/licenses//usr/share/licenses/docker-stable//usr/share/man/man1//usr/share/man/man5//usr/share/man/man8//var/lib/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:43178/SUSE_SLE-15_Update/545b0af8f22c09878e133db1f5ff6803-docker-stable.SUSE_SLE-15_Updatedrpmxz5ppc64le-suse-linux     directoryASCII textELF 64-bit LSB executable, 64-bit PowerPC or cisco 7500, version 1 (SYSV), statically linked, strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, not strippedELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=6ba4700b03c9ab849f359fff337559255226ad8e, for GNU/Linux 3.10.0, strippedUTF-8 Unicode texttroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) RRRRRRRRRRRRRRRRPPڷoANhz&oapparmor-parserdocker-stable-rootless-extraslvm22.2.89 utf-8a0a94082d29a787e218c6128a27b459219c5ec0f95d48d5be6ec1d1694f98dee?7zXZ !t/ &]"k%+f;ӡF5FCdz]X$G )e3Kꛗ ˯LNjd F\wLRPYMǴP +l~i, { }/ul| ~ok4 ѤHb#PXi* ]RloPp bY?&?u?)ֻ_дeaPUBug(ѩ%[-|2̮xeP z,ѭ`77ýw0LޛbHk; \o["CF(@Q=rh>V7^v-Mo0Ϫ"SZ]ͷM=pb'ls$ -kd|o8,.gLt JgeBnY/0pgԹ_F p.Cy;䯜 oگz(0 ­[2]ix^k?{YAr/z)pD vGֶO_K'$e`zIӠژVj9<89J-82 H%ݦZpNs1k_O>rJ`fñ}ߙJcXNS#-}S$doatɊ|HM/&Zw/n9Pe Z.P9sӶ1D@Nn\b>Y@tAYyəLJqczQ\/<|h]d+eu(!?)*T\`16_aO'PeJW4!]^6-HDM ؝|12y;ς>u^q2>>.,)*ih6l;27֘TQ!t{yMm!K4Qh1H `dy ,ٝN/Z>0k*PS`3)S-yAT)/\U8bk\#f9} cp1^ܹo! 70Y7q[j#Z*+gp6ZWSWӄ{ #"!g>f9l8 Y(#yoדR+[bO3qF<|]LZ'Rvk1A!o NA~ـNTW@ H4<@H#MwWkT f|\^ Q}Ì\Y snxt9-lJ t|*ZL:WU+8#%CWÚӒħ,١wOrFQe>8ePE4QD[y9FIXA8wg4ą_WcLb'45voR{m4b ERn`IbPgD:(l%dn37J({ wg\&'IȝK[f߁KH b M%)H~sKk<爌.mh}1Y>BwCTU̹ CU0L欶r$31Fnȴ4HT~lp ,'#E)Go$w7%g~w:*]KT.{JG_C;n,ɲ&7Ib'#*HyB30,ĸE!2- l\i<Wy>{aqdTZ<{|kj? HU1w1yG% v҃u䔮?鈑f|- 6_@~PwS{(1J8vرx N3D]ckY4z S ȌF1,F`Q}5f Dj>ep)d*:^$$D3c#f1ȜP$s2lḬJqna_XݰaUG -8pe*0.R/$MF3'=Q3#äM஗fз$ѐA5.1󭛪^֘m@MID(u,IڧV]JҟA*Dc5DF-k0E1{ =Tvr2KУrI<3ÈbUOٕnoj~aQzy?@vU;oW3 YZ